Two cities in Shizuoka Prefecture, Fuji and Shimada, have confirmed that personal data belonging to 928 civil-service exam applicants leaked through ApplyNow. ApplyNow is a recorded-interview and recruitment platform run by a subsidiary of Kichiri Holdings. Fuji accounts for 815 applicants and Shimada for 113, according to AliasFleet and the Japanese aggregator Security Measures Lab (セキュリティ対策Lab). The exposed data includes names, phone numbers and email addresses. Both cities have warned applicants about calls from people posing as city hall. No primary-tier source was available for this brief: every source below is secondary reporting on the cities' and ApplyNow's announcements, and figures are attributed as such. Fuji and Shimada are two of at least 17 organisations that have publicly linked their exposure to the same intrusion, which ran for roughly a month. The organisations range from municipalities to restaurant chains.
What Happened
The incident began at the vendor. ApplyNow's own disclosure, as reported by Act (株式会社アクト), IT Post, Omamori AI and Security Measures Lab, gives this sequence:
- 9 August to 7 September 2026: An attacker exploited a vulnerability in a data analysis tool ApplyNow used internally and reached part of its database.
- 7 September: ApplyNow detected abnormal access logs and cut off access the same day.
- 9 September: ApplyNow and its parent Kichiri Holdings (TSE Standard: 3082) announced the breach publicly. Record counts were still under investigation at that point.
- 10 September: ApplyNow told Fuji City that applicant data "may have leaked", according to Weekly TAKAPI (週刊TAKAPI).
- 11 September: Fuji announced a possible leak of about 800 records, as reported by Weekly TAKAPI.
- Early October: Fuji and Shimada moved from "possible" to "confirmed" leakage.
The confirmation date varies between sources. Security Measures Lab says both cities announced confirmed figures on 7 October. AliasFleet says the cities emailed every affected applicant an apology and warning by 7 October, and that the public announcement came on 8 October, reported by Daiichi-TV and Shizuoka Asahi TV. The likeliest reading is notification on 7 October and press coverage on 8 October, but the sources do not settle it.
Fuji's figure changed from about 800 "possibly exfiltrated" records in September (Weekly TAKAPI) to 815 confirmed. AliasFleet notes that no source explains the revision.
The scope of each city's exposure, per AliasFleet and Security Measures Lab:
- Fuji City: 815 applicants who took the presentation-video screening test in the 2022 through 2026 exam cycles.
- Shimada City: 113 applicants from the 2022 exam only (May to June 2022, general administrative track, university graduates).
What Was Taken
Applicant data. Reporting across sources lists:
- names in kana and kanji
- email addresses
- phone numbers
- exam numbers (Fuji)
AliasFleet also reports dates of birth and application receipt numbers. Its text implies these apply to Shimada, but only that one source says so, and it should be treated as unconfirmed.
City staff accounts at Fuji. Accounts differ. Weekly TAKAPI reports that Fuji's 11 September notice listed "company information" (administrator usernames, email addresses and permission levels) as possibly taken. AliasFleet lists city-side account exposure as unconfirmed. Readers should treat it as an open question.
What was not taken. ApplyNow, Fuji and Tokorozawa all state that interview videos and uploaded files (images, PDFs) sit in a separate storage area that the intrusion did not reach (Weekly TAKAPI, Act, Omamori AI). There is no evidence that the screening videos themselves leaked.
ApplyNow Sign data is a separate issue. ApplyNow's electronic employment-contract service, ApplyNow Sign, held:
- My Number (individual numbers)
- basic pension numbers
- bank account details
Act and Omamori AI report that this data may be affected. None of the sources ties these fields to Fuji or Shimada applicants. IT Post explicitly warns readers not to merge ApplyNow Sign exposure into other organisations' scope.
The wider victim count is moving and reported inconsistently:
| Source | Count |
|---|---|
| Security Measures Lab, as of 10 October | 17 organisations (7 companies or brands, 10 municipalities); a simple sum of 11,631 confirmed records or accounts, which it says is not a deduplicated count of people. An earlier version of the same report cited 11,515. |
| IT Post, Omamori AI (late September) | Six cities and about 3,000 records, mostly at the "possible leak" stage |
Figures for individual organisations, and where the sources disagree:
| Organisation | Reported figures |
|---|---|
| Iruma | About 1,200 (IT Post, Omamori AI); 1,276 confirmed (Weekly TAKAPI) |
| Tokorozawa | 1,701 confirmed (Weekly TAKAPI) |
| Fukuyama | 148 (IT Post); 155 applicants plus 13 staff (Omamori AI) |
| Osaka | 106 applicants (IT Post, Omamori AI); Security Measures Lab lists Osaka separately because the city did not name its vendor |
| Ichinomiya | About 600 |
| Uonuma | 116 (86 applicants and 30 city staff, including credential-related data and pass/fail status) |
| Nakabayashi | 1,826 |
| Yoshinoya and Hanamaru | 5,784 accounts (IT Post) |
Why It Matters
The immediate risk is targeted social engineering. A verified name, phone number and email, combined with the knowledge that the person applied for a specific city job, makes a convincing pretext. "This is Fuji City HR about your exam result" is a credible script. Both cities flagged impersonation calls. ApplyNow and Yoshinoya warned against any contact that asks for PINs, verification codes or bank transfers (Act, IT Post).
Old data stayed on the platform after the work was done. Shimada's exposure comes entirely from a 2022 exam, and Fuji's covers five exam cycles. Several sources raise the same retention problem:
- Weekly TAKAPI asks why records from finished exams still sat on the vendor's platform.
- Ichinomiya disclosed that data which should have been deleted at contract end remained because the vendor had not completed the deletion (IT Post).
- Yoshinoya reported the same finding (IT Post).
The data that leaked was data that had no reason to exist anymore.
This is a clear case of SaaS supply-chain concentration. None of the affected cities made a configuration error. As Omamori AI notes, under Japan's personal information protection law the city that outsourced the work keeps its own duty to report and notify. That is why every one of them had to publish an apology in its own name.
The Attack Technique
According to ApplyNow's disclosure as relayed by Act and Omamori AI, the entry point was a vulnerability in a third-party data analysis tool used inside ApplyNow's environment. It was not a flaw in the core recruitment application. ApplyNow has not named the product or the vulnerability.
The attacker went undetected for about a month (9 August to 7 September). Detection came from abnormal access logs.
Remediation, per Security Measures Lab and Act:
- blocking the analytics tool
- applying a security patch
- migrating to a new server environment
- an external forensic investigation
- forcing password resets for enterprise users
- reports to the Personal Information Protection Commission and police
Security Threat Information (secinfo.suppoza.com) suggests the tool was an unpatched component used as a pivot into the database. That is the outlet's own inference, not a confirmed finding. No threat actor has been named, and the sources report no ransom demand or leak-site listing.
What Organizations Should Do
- Inventory every SaaS vendor that holds personal data, including the ones HR bought. For each one, record the data fields held, the business owner and the contract contact. Recruitment and onboarding tools are often outside IT's view.
- Enforce deletion at contract and cycle end, then verify it. Require written certificates of deletion and audit them. Fuji, Shimada, Ichinomiya and Yoshinoya all had data exposed that was years old or past contract end.
- Ask vendors about their auxiliary tooling. Analytics, monitoring and integration tools that touch production databases should meet the same patch and access-control standard as the core application. Put this in security questionnaires.
- Keep sensitive fields separate. My Number, pension numbers and bank details should not live in the same data store as general applicant contact lists. Collect them only at the stage where they are legally required.
- Prepare impersonation guidance before you need it. Tell affected people how you will and will not contact them. For example: no requests for codes or transfers, and a call-back number they can verify. Send this guidance with the breach notice, as Fuji and Shimada did.
- Rotate credentials for any staff accounts on the vendor platform, and watch for phishing aimed at recruitment staff whose usernames or emails may have been exposed.
Sources: ApplyNow breach leaked 928 civil-service applicants | ApplyNow 不正アクセス まとめ-吉野家や鳥貴族、複数の自治体でも個人情報漏洩 確認分は延べ1万1,515件以上セキュリティ対策Lab | 職員採用試験サービス「ApplyNow」不正アクセス、なぜ6つの自治体・約3000件に拡大したのか。マイナンバーも対象の内訳を確かめる... | 「4年前の受験者情報まで」自治体の動画面接で個人情報漏えい 所沢・入間2,977件、富士市も約800件の可能性 – 週刊TAKAPI | 採用管理SaaS「ApplyNow」への不正アクセスが自治体6市に波及 — 大阪市106件・入間市約1,200件など職員採用の応募者情... | 吉野家・はなまるの採用情報が漏えい、対象は5,784アカウント。残存データとサービス別の情報を確認する｜IT Post | きちりHD子会社の採用管理SaaSに不正アクセス マイナンバーや口座情報が漏えいした可能性 - 株式会社アクト | 🔄 続報 ApplyNow、採用管理プラットフォームに不正アクセス｜セキュリティ脅威情報