VULNpocalypse
MediumBreach / campaignMonitoring

Suntory says data on around 100,000 people exposed through unauthorized access to a group cloud service

On 2 November 2026 Suntory said names and email addresses of about 100,000 employees, program registrants and job applicants leaked via a hacked cloud service.

Published
Exploitation
Yes. An intruder reached an external cloud service used by the Suntory group and exposed personal data of about 100,000 people; Suntory says no misuse has been confirmed

What happened

On Monday, 2 November 2026, Suntory Holdings said personal data on about 100,000 people had leaked after unauthorized access to an external cloud service used by the group (Kyodo via Yerepouni News). An OODA Loop brief dated 3 November 2026 described the same incident as involving “roughly 100,000 employees and customers” exposed through an unauthorized intrusion into an external cloud service (OODA Loop).

What data was exposed. Suntory’s breakdown of the roughly 100,000 figure, per Kyodo (Kyodo via Yerepouni News):

GroupCountData
Employees of group companies and affiliated firmsabout 90,000names and email addresses
People registered for its corporate activities experience program, as of the end of 2023about 7,300email addresses
Applicants for its 2026 new graduate recruitmentabout 7,200names

Suntory said the figure “does not represent the number of people affected, as some individuals may have multiple email addresses” (Kyodo via Yerepouni News). A separate summary reported that the leaked data included names, email addresses and phone numbers and that no credit card information was involved (BigGo Finance); the Kyodo based report lists only names and email addresses, so phone numbers are not confirmed.

The cause. Unauthorized access to an external cloud service used by the group (Kyodo via Yerepouni News, OODA Loop). Kyodo reported Suntory detected unusual activity in the service, then blocked the unauthorized access, and named the service as a Microsoft cloud service (Kyodo via Yerepouni News). The exact date of the intrusion and detection is not confirmed, and no attacker or group has been attributed.

Response. Suntory said it blocked the unauthorized access and that it has not confirmed any misuse of the information (Kyodo via Yerepouni News). No CVE has been assigned, and no specific software vulnerability has been named.

Context. The disclosure is one of several recent Japanese corporate data leaks reported around the same time. Nojima said unauthorized access to the member management system of its e-commerce site exposed about 7 million member records, including login IDs and encrypted passwords, with no confirmed credit card leak; Paycloud Holdings reported that unauthorized access to a subsidiary leaked about 77 million email addresses (BigGo Finance).

Am I affected?

You may be affected if, per Suntory’s own breakdown (Kyodo via Yerepouni News):

  • You are an employee of a Suntory group company or affiliated firm (name and email address).
  • You registered for Suntory’s corporate activities experience program on or before the end of 2023 (email address).
  • You applied to Suntory’s 2026 new graduate recruitment (name).

The exposed fields reported so far are names and email addresses. Phone numbers were mentioned by one secondary report but are not confirmed, and no credit card data was reported as involved (BigGo Finance). Suntory says it has not confirmed any misuse of the data (Kyodo via Yerepouni News).

What to do now

  1. Watch for phishing that uses your name and email. Names and email addresses are enough to craft convincing lures. Treat any message that claims to be from Suntory, a recruiter, or a program organizer with caution, and do not click links or open attachments you did not expect.
  2. Do not trust caller ID or sender names alone. If a message asks you to log in, pay, or confirm details, reach Suntory or the relevant service through a channel you already know rather than one supplied in the message.
  3. If you reused the exposed email as a login, make sure that account has a unique password and multi factor authentication, since a leaked address is a starting point for credential stuffing.
  4. If you run cloud services for an organization, review access to external cloud tenants: enforce multi factor authentication, check for unused or over privileged accounts and tokens, and turn on alerting for unusual sign in activity, which is how Suntory says it noticed this incident (Kyodo via Yerepouni News).
  5. Watch for official updates. Dates, the exact data fields, and the access path are still being clarified. Rely on Suntory’s own notices for confirmed details.

Sources