SHINDO3

National Personnel Authority

Applicants699people

POSSIBLE LEAKHealth / medical / treatment / Date of birthImproper disposal · Closed (final report)

Open in the live monitor ▶
Disclosed
Feb 13, 2026
Detected
Jan 29, 2026
Detection to disclosure
15 days
Leak
Leak possible
Type
Improper disposal
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityName, Date of birth, Gender
Special-care dataResults of physical examination, measurements and fitness tests

How many

  • Applicants 699 people

Who is affected

  • Applicants in 11 recruitment exams in fiscal 2022 to 2025

Cause

Forms kept in the exam officers' room were most likely discarded by mistake

Timeline

  1. Detected
  2. First disclosure

Response

  • Notified individuals

Explaining and apologizing to the applicants

What you should do

  1. Health data can't be taken back. Don't answer blackmail; call the police (#9110) or the consumer hotline (188)
  2. Expect targeted phishing posing as HR or interview contacts
  3. Check the company's notice to see if you're affected

Lessons for companies

  1. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  2. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources