2026 Gunosy — stolen internal business account exposed contact details of 132 people, including officers, staff and clients
Data compromised
For 25 client-side business contacts and 107 current or former officers, employees and others: names and email addresses; business contacts' company, department, title and phone numbers from email signatures. Some mailbox emails were viewed. The company says no misuse has been confirmed and that user data for its Gunosy, NewsLite, au Service Today and IR Hub services did not leak.
Technical writeup
The company notice was read through a summary tool; the ScanNetSecurity roundup is a secondary list. The count is the company's figure.
Root cause
Gunosy says an attacker logged in to an internal business account on October 21, 2026, and reached a mailbox, cloud environment and business tools. The company detected the login the same day, reported to Japan's Personal Information Protection Commission on October 23, and notified affected people on October 26. The initial credential theft method is unknown.