2026 TeamSpirit — data leak; 28,824 records from a dev server
Data compromised
28,824 unique personal-information records (deduplicated, as of the notice). 35 records are sensitive personal information (要配慮個人情報); those people get individual contact. Current and former TeamSpirit customers: names, emails, login IDs, identifiers, some inquiry records, some employee attendance records held outside production for service support, and some contract/environment data. Leads: identifiers and company names. Staff including leavers: names, employee numbers, work emails, join/leave dates, birthday month-day, internal IDs, business-system records. Production attendance data on the TeamSpirit service was not accessed. No public dump or misuse found as of 6 November.
Technical writeup
Root cause
On 27 October 2026 a third party logged into a software-development server, then used credentials stored there to pull data from a cloud environment TeamSpirit uses. Not a zero-day. The company says misconfiguration and information handling on the development server combined. That server was stopped the same day. PPC notified 30 October.