Japan Atomic Energy Agency: JRR-3 research-reactor user site breached, ID documents and radiation health exams taken

What happened

• JAEA confirmed unauthorized access on 25 Sep 2026 to a cloud-hosted research support site for external users of the JRR-3 research reactor (Tokai); 2,419 files were downloaded, 369 of which held personal data of 175 people, including photo ID images (driver’s licences, My Number cards, passports, residence cards) and special health examination results for radiation work. JAEA says the site is separate from its internal network.
• Root cause: under investigation; not disclosed.
• Attacker: not identified.
• Response: external access stopped, individuals notified, PPC and police informed.

Sources

• https://www.jaea.go.jp/02/press2026/p26100105/
• https://konbriefing.com/en-topics/cyber-attacks.html

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.