---
title: "Fujicco campaign applicant data incident"
description: "Fujicco reported possible exposure of approximately 15,500 campaign entries after unauthorized access to an outsourced processor’s server."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-26"
canonical_url: "https://www.ally.security/incidents/fujicco-campaign-applicant-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/fujicco-campaign-applicant-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/fujicco-campaign-applicant-data-incident-2026/stix.json"
---

# Fujicco campaign applicant data incident

Campaign-entry forms were suspended while the company investigated possible applicant-data leakage.

Last modified Oct 26, 2026 · 1 source

## Summary

- **Environment:** Outsourced server processing non-member campaign entries
- **Operational impact:** Affected server stopped and campaign-entry forms suspended
- **Financial impact:** No verified financial loss in the reviewed evidence

## What happened

[Fujicco](https://www.fujicco.co.jp/) said an unnamed company handling its campaign entries suffered unauthorized server access. Fujicco identified possible applicant-data leakage on October 21, 2026, and published its [notice](https://www.fujicco.co.jp/upload/pr_261022.pdf) the following day. The access date remains undisclosed. [1](#source-1)

## Impact

The potential exposure covered approximately 15,500 non-member entries for two campaigns conducted since May 2026. That figure includes repeat entries and is not a count of unique people. May describes the campaign period, not the beginning of the attack. Member, postcard and X entries were excluded. [1](#source-1)

Possible data fields included names, ages, gender, occupation, marital and family details, phone numbers, email and postal addresses, and survey answers. Driver’s licence, credit-card and bank-account information were excluded. Fujicco had not confirmed public posting or misuse, but was responding as though the information had been acquired. [1](#source-1)

## Timeline

### October 21, 2026 — Possible leakage identified

Fujicco identified possible leakage from the processor’s server and promptly stopped the affected server. [1](#source-1)

### October 22, 2026 — Public notice issued

The company disclosed the possible exposure and suspension of the affected campaign-entry forms. [1](#source-1)

### October 26, 2026 — Briefing updated

This briefing was last reviewed and updated on October 26, 2026.

## Threat Group & Attack Vector

The notice describes unauthorized access but gives no technical entry route. [1](#source-1)

### Actors

- Neither the attacker nor the outsourced processor is named.

### TTPs

- No specific MITRE ATT\&CK technique is supported by the available evidence.

## Response

Fujicco described reporting to Japan’s Personal Information Protection Commission, consulting police and planning a complaint. It planned direct email notifications and consolidation into a verified environment with stronger monitoring. Reopening had not been scheduled. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/fujicco-campaign-applicant-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### 不正アクセスによる個人情報漏えいの可能性に関するお詫び

official · Fujicco Co., Ltd. · Oct 22, 2026

<https://www.fujicco.co.jp/upload/pr_261022.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Possible applicant-data leakage identified: 2026-10-21
2. **Resulted In · 100% confidence · current**  
   Fujicco campaign applicant data incident: Fujicco publishes notice
3. **Resulted In · 100% confidence · current**  
   Fujicco campaign applicant data incident: The notice describes reporting to the Personal Information Protection Commission and plans for a police complaint and direct email notifications. Systems would be consolidated into a verified environment with stronger monitoring; reopening was not scheduled.
4. **Resulted In · 100% confidence · current**  
   Fujicco campaign applicant data incident: Fujicco had not confirmed public posting or misuse, but was responding on the assumption that data had been acquired.
5. **Resulted In · 100% confidence · current**  
   Fujicco campaign applicant data incident: Potential fields include names, ages, gender, occupation, marital and family details, phone, email, address and survey answers. Driver’s licence, credit-card and bank-account data are excluded.
6. **Affected Organization · 100% confidence · current**  
   Fujicco campaign applicant data incident: Fujicco Co., Ltd.
7. **Resulted In · 100% confidence · current**  
   Fujicco campaign applicant data incident: Fujicco identified possible campaign-applicant data leakage on October 21 after unauthorized access to an unnamed processor’s server. It stopped the affected server and suspended the relevant entry forms.
8. **Resulted In · 100% confidence · current**  
   Fujicco campaign applicant data incident: The scope is approximately 15,500 non-member entries for two campaigns run since May 2026, including repeated applications by the same person. Member, postcard and X entries are excluded.
9. **Resulted In · 100% confidence · current**  
   Fujicco campaign applicant data incident: Possible applicant-data leakage identified
10. **Occurred At · 100% confidence · current**  
   Fujicco publishes notice: 2026-10-22
11. **Disclosed At · 100% confidence · current**  
   Fujicco campaign applicant data incident: 2026-10-22
12. **Discovered At · 100% confidence · current**  
   Fujicco campaign applicant data incident: 2026-10-21

</details>