TeamSpirit said on 6 November 2026 that a third party logged into a software-development server on 27 October, then used credentials stored on that server to pull data from a cloud environment the company uses. The catalog entry records 28,824 unique personal-information records, with 35 of them classed as sensitive (要配慮個人情報). Current and former customers, some leads, and staff including leavers are in the file. The company says the live TeamSpirit attendance and time-tracking service was not accessed. The attendance snippets that did leak were copies held outside production for service support. Japan's Personal Information Protection Commission was told on 30 October.
Cause, in the company's words, was not an unknown vulnerability. Misconfiguration and information handling on a development server combined. That is a mundane path with a serious result: support copies of workforce data sitting next to credentials that could reach cloud storage. The development server was stopped the same day. Stolen credentials were largely invalidated. Individual notices started on 6 November. Where TeamSpirit has no address, the public post stands in.
What happened in the TeamSpirit data leak?
Someone reached a box that developers used, not the customer-facing SaaS login. From there they reused stored credentials to fetch data from cloud storage. TeamSpirit brought in outside security help and lawyers. It has not published the exact login method, on purpose, so copycats get less of a map. "We will not describe the technique" is not the same as "we do not know."
HR and attendance vendors are attractive because the files mix identity with when someone was at work. Even a partial copy is enough to write a fake "your timesheet was rejected" mail. This incident is closer to SMBC Consumer Finance's guarantee-system leak than to a consumer app ID leak such as SmartNews: a B2B platform, a five-digit census, and partner companies whose staff may never have heard of the vendor.
The production-versus-copy distinction matters. If your company's live TeamSpirit tenant was not opened, payroll for last month may still be intact. The leaked attendance records are still personal data. Treat them as exposed for the people TeamSpirit names in the follow-up mail.
What data was leaked?
Customer contacts and users: names, emails, login IDs, TeamSpirit-managed identifiers and account data, some inquiry records, some employee attendance records held for support, and some contract or environment information. Leads who asked for materials or attended a seminar: identifiers and company names. TeamSpirit staff and leavers: names, employee numbers, work emails, join and leave dates, birthday month and day, internal usernames and IDs, and business-system records. Items vary by person. Thirty-five records are sensitive personal information under Japanese law. Those people get a specific letter.
28,824 is a deduplicated count as of 6 November, not a marketing maximum. It can still move if the investigation finds more. There was no confirmed public dump or misuse at notice time.
Who is affected?
People at companies that use or used TeamSpirit, some people who only asked for a brochure, and TeamSpirit employees including those who have left. End users of a customer tenant may be in the attendance-copy slice even if they never emailed TeamSpirit support. If you get a mail from support-2026@teamspirit.com that matches the public post, you are in the matched set. If you use TeamSpirit every day and hear nothing, wait; the company is writing in sequence and uses the public page when it has no address.
What should I do?
- Read the TeamSpirit letter if it arrives. Compare the sender with the 6 November post. The inquiry mailbox is support-2026@teamspirit.com. Do not use a lookalike domain.
- Customer admins: rotate TeamSpirit logins you reused elsewhere. The live tenant was not reached, the company says. Reused passwords still matter because login IDs leaked.
- Staff whose attendance copies may be in the support file should watch for fake HR mail about missed clock-ins.
- TeamSpirit says it will not ask for passwords by email or phone. Anyone who does is not TeamSpirit.
- Keep the notice. If the 28,824 figure or the 35 sensitive-record figure changes, that update is the one to keep with a labour or privacy complaint.
The SMBC Consumer Finance notice post is the same matching-delay problem: phishing is loudest while official letters are still going out.
Frequently asked questions
Was the live TeamSpirit product hacked?
TeamSpirit says unauthorised access to attendance and time data on the production service has not been confirmed. The leaked attendance records were copies in a company-managed environment.
What are the 35 sensitive records?
The notice calls them 要配慮個人情報 and says those people will be contacted individually. It does not itemise the 35 in public.
Is 28,824 the final count?
It is the deduplicated count as of 6 November. The company said it will update if the investigation finds more.
Was this ransomware?
The company described a development-server login and a cloud data pull. It did not name a ransomware group or a leak site.
Should customer companies tell their employees?
If TeamSpirit names your tenant in a letter, follow that letter. The public post is the fallback when TeamSpirit cannot reach someone.
Sourcing note: dates, 28,824, the 35 sensitive records, the development-server path and the production-exclusion come from TeamSpirit's 6 November notice.