2026 JNSA — security-literacy check; up to 15,128 admin/user records; hashed passwords
Data compromised
Maximum 15,128: administrator name, company, email; organisation location, headcount, industry; user count; user IDs and hashed passwords. Count is a maximum possible, not a confirmed take of every field for every person. Test scores not listed. recordsAffected 15128 as the published ceiling.
Technical writeup
JNSA first report 6 Nov 2026. Separate from JNSA's Blastmail vendor notice (emails only; JNSA says its Blastmail data was not in that leak).
Root cause
Unauthorised access to JNSA's information-security literacy check, confirmed 4 November 2026. Access may have begun around the night of 30 October. Intrusion path unpublished. Service stopped. PPC report planned 6 November.