SHINDO5

United Arrows Ltd.

Personal data~10,000people

LEAK CONFIRMEDPhone number / Trade secretsInsider misuse · Closed (final report)

Open in the live monitor ▶
Disclosed
Mar 16, 2026
Detected
Jan 6, 2026
Detection to disclosure
69 days
Leak
Leak confirmed
Type
Insider misuse
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityFull name
Employment & HREmployer company name, Department
ContactPhone number, Email address
Business dataBusiness partner lists and part of the PR materials

How many

  • Business contacts and others ~10,000 people

Who is affected

  • Business contacts and others

Cause

A former employee who left on December 31, 2025 used the cloud server's external-link function on January 4, 2026 to take the data

Timeline

  1. A former employee used the cloud server's external-link function to download and take the data
  2. Data removal discovered
  3. Official announcement

Response

  • Access review
  • Config review
  • More monitoring
  • Staff training

Tightened access restrictions, reviewed system security, strengthened monitoring and stepped up staff training

What you should do

  1. Don't open links in emails from this company. The apology email itself may be fake
  2. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  3. Check the company's notice to see if you're affected

Lessons for companies

  1. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  2. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources