--- title: "Japan Chamber of Commerce exam-system intrusion" description: "JCCI confirmed an exam-management server intrusion with possible exposure of approximately 980,000 people; actual leakage remained unconfirmed." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-11" canonical_url: "https://www.ally.security/incidents/jcci-exam-management-system-intrusion-2026" markdown_url: "https://www.ally.security/incidents/jcci-exam-management-system-intrusion-2026.md" stix_url: "https://www.ally.security/incidents/jcci-exam-management-system-intrusion-2026/stix.json" --- # Japan Chamber of Commerce exam-system intrusion JCCI confirmed an exam-management server intrusion with possible exposure of approximately 980,000 people; actual leakage remained unconfirmed. Last modified Nov 11, 2026 · 1 source ## Summary - **Environment:** Externally hosted exam-provider management server - **Operational impact:** Malicious file removed and server patched; exams continued - **Financial impact:** No confirmed incident cost quantified ## What happened The [Japan Chamber of Commerce and Industry](https://www.jcci.or.jp/) confirmed unauthorized access to an exam-management server on November 4, 2026. A malicious file had been installed November 1. [1](#source-1) ## Impact Potential exposure covered up to approximately **980,000 people and 1,970,000 records**, for eight exam types taken April 2022–November 2026. Names, birth dates, results, scores and optional contact details were involved; payment information was excluded. Actual leakage and misuse remained unconfirmed. [1](#source-1) ## Timeline ### November 1, 2026 — Malicious file installed The file was found during investigation. [1](#source-1) ### November 4, 2026 — Access confirmed and patched The file was removed and patches applied late that day. [1](#source-1) ### November 9, 2026 — Potential scope established JCCI reported to the privacy regulator. [1](#source-1) ### November 10, 2026 — Public disclosure JCCI published its [notice](https://www.jcci.or.jp/news/news/2026/1110170000.html). [1](#source-1) ### November 11, 2026 — Briefing updated This briefing was last reviewed and updated on November 11, 2026. ## Threat Group & Attack Vector The server supported exam providers’ reservations and results; candidates did not access it directly. The notice does not identify a specific exploit or malicious-program type. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific ATT\&CK technique is mapped from the available evidence. ## Response JCCI said exams could continue normally after patching and warned candidates about impersonation messages. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### JCCI notice of possible candidate-data leakage from exam management system official · Japan Chamber of Commerce and Industry · Nov 10, 2026
Evidence ledger Review the supporting structured claims. 1. **Discovered At · 100% confidence · current** Japan Chamber of Commerce exam-system intrusion: 2026-11-04 2. **Occurred At · 100% confidence · current** Public notification issued: 2026-11-10 3. **Resulted In · 100% confidence · current** Japan Chamber of Commerce exam-system intrusion: The file was removed immediately and patches applied late November 4. The system is used by exam providers for reservations and results, not directly by candidates. 4. **Occurred At · 100% confidence · current** Malicious file installed: 2026-11-01 5. **Resulted In · 100% confidence · current** Japan Chamber of Commerce exam-system intrusion: Unauthorized access confirmed and patched 6. **Resulted In · 100% confidence · current** Japan Chamber of Commerce exam-system intrusion: Public notification issued 7. **Disclosed At · 100% confidence · current** Japan Chamber of Commerce exam-system intrusion: 2026-11-10 8. **Resulted In · 100% confidence · current** Japan Chamber of Commerce exam-system intrusion: On November 9 investigators identified possible exposure of up to approximately 980,000 people and approximately 1,970,000 records. Neither actual leakage nor misuse had been confirmed. 9. **Resulted In · 100% confidence · current** Japan Chamber of Commerce exam-system intrusion: Malicious file installed 10. **Resulted In · 100% confidence · current** Japan Chamber of Commerce exam-system intrusion: JCCI reported to Japan’s Personal Information Protection Commission November 9 and said exams could continue normally after patching. 11. **Occurred At · 100% confidence · current** Unauthorized access confirmed and patched: 2026-11-04 12. **Affected Organization · 100% confidence · current** Japan Chamber of Commerce exam-system intrusion: Japan Chamber of Commerce and Industry 13. **Resulted In · 100% confidence · current** Japan Chamber of Commerce exam-system intrusion: Potential scope determined and regulator notified 14. **Occurred At · 100% confidence · current** Potential scope determined and regulator notified: 2026-11-09 15. **Resulted In · 100% confidence · current** Japan Chamber of Commerce exam-system intrusion: A malicious file was installed November 1 on an externally hosted exam-management server. JCCI confirmed unauthorized access from its system-management company’s November 4 report. 16. **Resulted In · 100% confidence · current** Japan Chamber of Commerce exam-system intrusion: Potentially affected records covered eight exam types taken April 1, 2022 through November 4, 2026: names, phonetic names, gender, birth dates, pass/fail results, scores and optional contact fields. Payment and credit-card data were excluded.