SHINDO4

NHK

Japan Broadcasting Corporation

Email addresses~32,940people

LEAK CONFIRMEDMisdelivery · Closed (final report)

Open in the live monitor ▶
Disclosed
Mar 18, 2026
Leak
Leak confirmed
Type
Misdelivery
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

ContactEmail address

How many

  • Email addresses ~32,940 people
  • Of which email addresses of outside business partners 8,553 people

Who is affected

  • NHK staff and staff of affiliated organizations
  • Outside contractors

Cause

A staff member of the outside maintenance contractor set the recipients of an approval-request email wrongly and sent it to all registered system users

Timeline

  1. Misdirected email sent
  2. Announced

Response

  • Data deleted
  • Change process
  • Config review

Asked recipients to delete the email; reviewed the mail function and modified the system to prevent recurrence

What you should do

  1. Don't open links in emails from this company. The apology email itself may be fake
  2. Expect targeted phishing posing as HR or interview contacts
  3. Check the company's notice to see if you're affected

Lessons for companies

  1. Put security requirements, audit rights and reporting deadlines in vendor contracts
  2. Use DLP: recipient checks, send delay, automatic attachment protection
  3. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  4. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources