Lemma Critical Brief
How attacks and accidents get through
Real cyber attacks and incidents, read from public disclosures: what was missing, and how to counter it.
Read now
36 municipalities suspended the service
SpeeCAN RAIDEN breach: fake mail sent from the disaster-alert domain Nothing let recipients check, beyond the sender display, that a notice came from the municipality. Read 177,000 policyholders' data sent to another insurer
TOPPAN sent 177,426 Sompo Japan policyholder records to another insurer Nothing checked, before the send, that the contents matched the recipient. Read About ¥9M lost at one hotel
Booking.com payout account switched, ¥9M lost — Polaris Holdings Nothing had someone else confirm a payout-account change before money moved. Read Browse by control
US2026-10-24 · Government & public sector · Impersonation City of Liberty, Texas, wired ~$600K on a lookalike-domain request that matched a real debt About $600K wired in response to a request from a lookalike vendor domain Japan2026-10-24 · Media & content · Impersonation Hatena: scammers posing as police remote-controlled a finance PC, and ¥1.18 billion flowed out The head of accounting's PC was remote-controlled, and about ¥1.18 billion went to outside accounts (booked as an extraordinary loss) US2026-10-24 · Manufacturing & critical infrastructure Orion: a scheme targeting one employee sent multiple wires to outside accounts — a $59.2M unrecovered loss A scheme targeting an employee sent transfers to third-party accounts; $59.2M was booked as unrecovered (part later recovered) US2026-10-24 · Government & public sector · Impersonation City of Baltimore: a fake supplier contact switched the bank account, and $1.52M went elsewhere $1.52M in supplier payments went to the fake contact's account; about $0.8M was not recovered Japan2026-10-24 · Finance & FinTech · Impersonation ZUU paid ¥96M on a business-chat instruction from a fake executive — the same day A chat instruction from a fake executive sent ¥96M to an outside account (booked as an extraordinary loss) US2026-10-24 · Government & public sector · Impersonation City of Portland: a supplier's bank account was switched, and a $6.7M water-plant payment went elsewhere A $6.7M water-plant payment went to an account named by someone posing as the contractor (later fully recovered) UK2026-10-23 · Government & public sector · Human error Met Police: data on 179 people put on a platform wrongly said to be approved (ICO) Personal data on 179 people uploaded to an unapproved outside platform UK2026-10-23 · Services & retail · Impersonation ASOS: a rogue "Asos hacked" app notification, and an employee login later disclosed as stolen The attacker's message reached customers as an official app notification, and names, contact details and more were accessed (NCSC, press) South Korea2026-10-23 · Media & content · Account takeover Korea's TVING: a developer key led into production and data on 39.5M accounts leaked User data from 39.5M accounts (including duplicates) leaked Japan2026-10-23 · Procurement & supply chain · Account takeover Cuenote FC email delivery breached: about 9 million records with email addresses About 9 million records with email addresses output (estimate) Japan2026-10-22 · Government & public sector · Supply chain An attack on NEC's contractor leaked data on 77,851 Osaka University people 77,851 people's data leaked at Osaka University; systems down at Osaka Metropolitan University Japan2026-10-20 · Procurement & supply chain · Supply chain Studio: a SaaS breach read the decryption keys too, reaching customer companies' form data
Browse all 163 Briefs