SHINDO4

Benefit One

Benefit One Inc.

Personal data13,460people

LEAK CONFIRMEDDate of birth / HR / labour recordsSoftware defect · Investigating

Open in the live monitor ▶
Disclosed
Sep 30, 2026
Detected
Oct 2025
Detection to disclosure
364 days
Leak
Leak confirmed
Type
Software defect
Status
Investigating
Security spend
Measures, no amount
Compensation
Not announced
Corporate number
8011001045281

What leaked

Employment & HREmployee/staff number, Company name, Department and job title, Department and job title, Employment information
IdentityFull name, Gender, Date of birth

How many

  • Employees of client companies 13,460 people
  • Companies and organizations 2,322 organizations

Who is affected

  • Employees of client companies

Cause

Flawed program conditions in the survey-results download function (introduced in a June 2025 system update; identified internally in October 2025 but not fixed)

Timeline

  1. Exposure began
  2. Identified internally but not fixed
  3. Detected
  4. First disclosure

Response

  • Forensic investigation
  • Governance / committee
  • External audit

Root-cause analysis, strengthened information security and personal data management, assessment by outside experts

What you should do

  1. Check the company's notice to see if you're affected

Lessons for companies

  1. Never sit on a known defect. Test every change before production
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources