Release date: November 12, 2026
Cyber Security Cloud, Inc.

We would like to express our sincere gratitude for your continued support.

We are writing to inform you that we have detected suspicious access to our company-managed area onGitHub, which we use for software development, and that there is a risk of personal information being leaked from that area.

We sincerely apologize to our customers and all those involved for the worry and inconvenience caused.
As a company providing security services, we take this matter very seriously and will work company-wide to prevent recurrence and restore trust.

We would like to inform you of the information we have gathered so far and our response to the situation as follows.

*GitHub is a service for managing information related to software programs and development.

1. Overview and background of this case

Information provided by an external organization revealed that one of our employees' GitHub credentials, used for work purposes, had been leaked. Subsequently, an investigation of GitHub access logs confirmed on November 5, 2026, that suspicious access, believed to have been made by a third party using the aforementioned credentials, had occurred in the past.

Please note that due to limitations in the period and content of the access logs that can be reviewed, we have not been able to confirm the access status for the entire period during which the authentication information was valid.
We will continue our investigation and take necessary actions.

2. Information at risk of leakage

The following information stored on our GitHub repository may have been viewed or obtained by a third party, and therefore may be at risk of being leaked.

- Some customer information (company name, name, email address, etc.)
• Communication-related information associated with using the service

We are currently investigating the scope of personal information that may have been leaked and the individuals affected. We will contact customers who are confirmed to be affected in due course. In addition, for personal information that we have been entrusted with handling by our customers, we will work in cooperation with the entrusting customers to take necessary measures, such as notifying the individuals concerned.

3. Impact on and availability of our services

At this time, we have not confirmed any unauthorized access to our services, unauthorized operations, or secondary damage resulting from this incident.
Furthermore, we have not confirmed any impact on the provision of our services or security functions, and we are continuing to provide each service as usual.

4. Our response

Following the discovery of this incident, we are taking all necessary measures to prevent further damage, and are also investigating the cause and route of the leaked authentication information and the scope of its impact.
We are also working to prevent this from happening again.

◼︎Measures taken to prevent further damage

- Disable leaked GitHub credentials

- Check and modify various authentication information related to other services that was stored on GitHub.

Review and modification of various related authentication information and access permissions.

- Isolation of the relevant development terminals and suspension of their accounts.

◼︎ Investigation of the cause and scope of impact, and ongoing efforts to prevent recurrence

- Investigation of access logs, etc., for GitHub and related systems

- Forensic investigation by our security engineers and external expert organizations

Identifying personal and customer information that may have been leaked and investigating the scope of the impact.

- Review of the authentication information management system and security measures to prevent recurrence.

◼︎ Reporting to and responding to relevant organizations

We have reported this matter to the Personal Information Protection Commission and other relevant organizations, and we are continuing to work with them to take the necessary steps.

Regarding the reporting procedures to the Personal Information Protection Commission by the client companies concerned, we are currently consulting with them on reporting methods, including joint reporting.
We will inform you of the details as soon as they are finalized.

We will continue to take necessary measures based on the investigation results, and will provide appropriate guidance and support to our customers and other stakeholders.

If any further information becomes available through our investigation, we will promptly inform you.

[Contact information for inquiries regarding this matter]

For inquiries regarding this matter, please contact the following office.

・お客様・パートナー様からのお問い合わせ先：csc-customer@cscloud.co.jp

・株主様・投資家様からのお問い合わせ先：csc-ir@cscloud.co.jp