SHINDO3

Tokyo Monorail

Personal data~3,400people

POSSIBLE LEAKHR / labour records / Documents / filesLoss · Closed (final report)

Open in the live monitor ▶
Disclosed
Apr 24, 2026
Detected
Apr 3, 2026
Detection to disclosure
21 days
Leak
Leak possible
Type
Loss
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

Employment & HRCommute management records, Daily work reports
ContactContact details of customers and business partners
Communications & contentMeeting materials with business partners

How many

  • Personal data on about 3,400 people including employees ~3,400 people

Who is affected

  • Employees
  • Customers
  • Related business partners

Cause

A desktop PC kept in a warehouse for disposal after being replaced could not be found

Timeline

  1. After replacement with new equipment the PC was kept in a warehouse
  2. Detected
  3. Security NEXT report date; the organization's own announcement date was not confirmed

Response

  • Notified individuals

Notified customers whose contact details are known individually

What you should do

  1. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  2. Expect targeted phishing posing as HR or interview contacts
  3. Check the company's notice to see if you're affected

Lessons for companies

  1. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  2. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources