Products Lemma APIProof issuance & verification platformTrust402Delegate to agents, and transactSealSign-in for the agent era — no keys handed over
Use cases Manufacturing & Critical InfraInspection Record AssuranceFinance & FinTechCounterparty Record VerificationPublic SectorCertificate-less ProceduresHealthcareQualified Worker AssuranceProcurement & Supply ChainSupplier Credential MonitoringMedia & ContentContent AuthenticityService & RetailCross-group IdentityAI Adoption (cross-industry)AI Run GovernanceDevelopers & Agent OpsAgent Authority Control ▸ Browse the use-case index
Pricing
Resources Critical BriefThe frontier of AI × trustBlogThinking and implementation notesDocumentationAPI & specsVerification CenterReal verification & issuance countsAbout usFRAME00, Inc.ContactSales & press inquiriesGlossaryDefinitionsFAQFrequently asked questions
Get Started ↗ JA
Lemma Critical Brief

How attacks and accidents get through

Real cyber attacks and incidents, read from public disclosures: what was missing, and how to counter it.

RSS feed Methodology

Read now

Government & public sector · Impersonation 36 municipalities suspended the service
SpeeCAN RAIDEN breach: fake mail sent from the disaster-alert domain Nothing let recipients check, beyond the sender display, that a notice came from the municipality. Read
Finance & FinTech · Human error 177,000 policyholders' data sent to another insurer
TOPPAN sent 177,426 Sompo Japan policyholder records to another insurer Nothing checked, before the send, that the contents matched the recipient. Read
Services & retail · Account takeover About ¥9M lost at one hotel
Booking.com payout account switched, ¥9M lost — Polaris Holdings Nothing had someone else confirm a payout-account change before money moved. Read

Browse by control

Changes confirmed by someone else, another way 9 briefs Check the sender or account is genuine 59 briefs Hold payments or sends until confirmed 48 briefs Record who confirmed what 22 briefs

More recent briefs

2026-10-22 · Government & public sector · Supply chain An attack on NEC's contractor leaked data on 77,851 Osaka University people 77,851 people's data leaked at Osaka University; systems down at Osaka Metropolitan University 2026-10-20 · Procurement & supply chain · Supply chain Studio: a SaaS breach read the decryption keys too, reaching customer companies' form data 2026-10-20 · Government & public sector · Human error Tokyo Metropolitan Housing Supply Corporation, 770 names misdirected: no check that labels matched the list before dispatch Names of 770 association heads reached other residents 2026-10-20 · Services & retail Sourcenext, up to 22.52 million records: no check on the volume and purpose of member-information API calls Up to 22.52 million member records may have leaked 2026-10-20 · Procurement & supply chain · Supply chain ConnectWise: a vendor's app identity granted itself Global Administrator in some customer tenants Sign-in activity in about 1,000 tenants, more than 300 successful 2026-10-20 · Media & content Comic C'moA breach: system logs taken along with member data Five member-data fields and some system logs leaked 2026-10-14 · Government & public sector · Privilege abuse Denmark CPR: a company's lawful access was abused to pull data on 8.8 million people Names, addresses and CPR numbers of about 8.8 million people retrieved 2026-09-24 · Developers & agent operations · Impersonation North Korean IT workers won contracts in Japan with ID images supplied by local enablers Japan's first laptop farm dismantled; hundreds of millions of yen sent abroad 2026-09-21 · Finance & FinTech · Impersonation Revolut answered data requests from Italy's certified state email Customer data handed over for months 2026-09-15 · Developers & agent operations · Supply chain RubyDoc.info doc builds ran arbitrary code from 500+ RubyGems spam packages 500+ malicious packages removed 2026-09-15 · Developers & agent operations · AI failure or misuse GitSpawn: seven AI coding agents run code via git config Code ran in 7 AI coding agents 2026-09-11 · AI adoption (all industries) · Supply chain Transformers writes remote code to disk before consent check (CVE-2026-80047)
Browse all 153 Briefs