EXPLORINEER
en

JP — ITmedia

Nifty May Have Leaked Over 540,000 Records in Unauthorized Access to Optical Line Application System

Security1 min read

Nifty, a Japanese internet provider, says that up to 542,513 customer records may have leaked after hackers got into a system used for optical fiber internet sign-ups.

What happened

On October 19, 2026, Nifty found that someone had broken into its internal system for handling line applications and reception management. The company says personal data may have leaked. The attack hit an internal system, not the sign-up forms on Nifty's website. The attacker's connection has already been blocked.

Key facts

  • Up to 542,513 records may have leaked.
  • The data may cover people who applied for optical fiber services from outside Nifty's website since 2019.
  • Possible leaked items: member ID, name, gender, birth date, address, phone number, and email address.
  • Bank account and credit card information are not included, the company says.
  • The break-in was found at about 10:20 a.m. on October 19.

Some terms explained

Optical fiber internet uses thin glass cables to send data very fast. A “sign-up system” is the computer system that stores and processes customer applications. “Unauthorized access” means someone entered a computer system without permission.

Why it matters

Personal details like names, addresses, and phone numbers can be misused for scams or fake messages. Customers who signed up for these services in the past may need to watch for suspicious contact. Bank and credit card details were not included, which lowers one major risk.

What to watch

  • Results of Nifty's detailed investigation.
  • Reports to the Personal Information Protection Commission, Japan's privacy watchdog.
  • Any new facts that show the leak is larger or different.
  • Official notices from Nifty about what affected customers should do.
Security전자신문

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

SecurityVnExpress

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.

Security전자신문

Election Deepfakes Up 27% Worldwide; South Korea Ranks Third in Cumulative Cases

Reported AI-generated election deepfakes surged worldwide, with January to September 2026 cases already exceeding last year's full-year total by 27%, according to a Surfshark study. South Korea ranks third globally in cumulative cases with 16 since 2021, behind the United States and India. The study counted 235 cases across 46 countries from January 2020 to September 2026.