JP — ITmedia

Failure to Notice a Published Vulnerability Led to Leak of 396,920 People's Data; Recruiting Service ApplyNow Also Exposed Some My Numbers and Bank Account Information

SecurityNovember 5, 20262 min read

ApplyNow, a Japanese company that runs hiring software, says personal data of 396,920 people leaked after hackers broke into its system. Some records included My Number (Japan's national ID number) and bank account details.

What happened

ApplyNow, a Tokyo-based company that offers recruiting services, said on November 4, 2026 that the personal data of 396,920 people had leaked. The hack happened in August 2026, and the company first announced it on September 9. In October, it had said about 390,000 people were affected. A later check gave the final count. Some records included My Number, basic pension numbers, and bank account details.

Key numbers and facts

396,920 people affected in total, across job applicants, contract signers, and company users
30,067 of those were people who signed employment contracts through ApplyNow Sign
Hackers entered the system on August 9, 2026 and copied a large part of the data on September 7, 2026
Credit card details, ID photos, and interview videos were not leaked, according to the company
As of November 4, no misuse of the leaked data had been seen

How the attack worked

The hackers used a known flaw in a data analysis tool that ApplyNow used inside the company. A flaw is a weak spot in software that attackers can exploit. The hackers gained admin rights and looked at parts of the database in late August. On September 7, they took the data in one large batch. The company noticed the problem when it stopped the tool, then shut down the fake accounts and blocked the entry route.

Why it matters

The company did not know the tool's maker had already published a warning about the flaw, so the fix came late. It also had no limit on where connections could come from, and it kept data after contracts ended. Leaks of My Number and bank details can put people at risk, so this case shows why companies must patch software quickly, limit access, and delete data they no longer need.

What to watch

Whether ApplyNow deletes data from ended contracts as planned
Whether the company adds automatic alerts for suspicious actions
Whether it sets clear limits on how long personal data is kept
Whether any leaked My Number or bank details are misused

Glossary

ApplyNow: A Japanese company that offers recruiting and hiring services, including interview and online contract tools.
ApplyNow Sign: An ApplyNow service for signing employment contracts online.
My Number: Japan's national ID number used for tax and social security records.

Strengthening Cybersecurity at Medical Institutions: Long-Term Risks to Patient Care from Ransomware Attacks

Japan's Ministry of Health, Labour and Welfare plans to significantly strengthen cybersecurity at medical institutions next fiscal year, requesting 13.7 billion yen for the project in its FY2027 budget request, up from 100 million yen in the FY2026 initial budget. A ransomware attack can make electronic medical records unusable for long periods and disrupt patient care, and the ministry's survey found many hospitals have numerous external connection points that are hard to manage and lack cybersecurity specialists. The ministry will support consolidation of external connections, use of specialists listed by IPA, and initial response to incidents.

Securityheise onlineNov 5

Patch now! Attacks on Zyxel switches observed

Admins must install current security updates to stop ongoing attacks on Zyxel GS1900 switches, as attackers can otherwise access devices and copy credentials. The flaw (CVE-2026-107441, CVSS 8.8, rated "high") can be exploited without authentication from the local network via a crafted HTTP request, and patches are provided only for models still within their support period. Researchers at Binarly found that the exploit used against the earlier CVE-2026-7273 also worked on the firmware meant to fix it, and the Canadian Cyber Centre has also warned of exploitation.

SecurityVnExpressNov 5

Hackers attack refrigeration systems at France's blood bank

Hackers targeted a refrigeration equipment supplier, raising storage temperatures at France's national blood agency (EFS) from -30°C to 110°C in three facilities in Bourgogne-Franche-Comté. A night-shift staff member noticed the abnormal rise and technical staff acted before any blood samples or products were damaged. EFS moved its products to other storage sites and is working with France's cybersecurity agency and the Ministry of Health on the investigation.

SecurityITmediaNov 5

Mos Burger, Workman, IIJmio Among Firms Announcing Customer Data Leaks from Unauthorized Access to Ararа

Companies using mail delivery service provider Arara are announcing customer data leaks linked to unauthorized access to the service. Mos Food Services (Mos Burger), Workman, IIJ, and Sumitomo Fudosan were among those announcing on November 4, with Arara estimating up to about 380 contracted companies may be affected. Mos Food Services reported that 7,517,087 records of its member data, including email addresses, were leaked, without payment card information.