Paiza says a staging access gap put up to 902,576 records at risk
Paiza says its staging environment used a fixed access password and could be reached externally by former staff or others who previously had access. Up to 902,576 records were reachable before Paiza restricted network access. Paiza has not confirmed data exfiltration.
- Disclosed
- Nov 13, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Paiza users and business contacts whose data was copied into the staging environment between 2013 and August 13, 2026.
- Data exposure · Staging · Japan
- In the wild
- Unknown
What happened
Paiza copied production data into its test environment after applying masking to fields including names, home addresses, phone numbers, primary email addresses and passwords. It identified periods when some fields were not masked. The potentially reachable dataset includes identifiers such as GitHub IDs, profile and skills assessment data, recruitment activity, some contact addresses and business contacts. Paiza gives affected periods by field in its notice.
The company gives a maximum number of records, with no confirmed exfiltration or downstream misuse. It says it will strengthen offboarding, revisit masking standards and conduct regular security assessments.
Crime-scene timeline
Jul 17, 2026
Paiza investigates after an inquiry from authorities
The company finds an access-control gap in its staging environment. It dates exposure to the period from setup in 2013 until the August access restriction.
Aug 13, 2026
Paiza restricts access to internal routes
Paiza says it completed the network change and subsequently revised internal security guidance.
Nov 13, 2026
Paiza discloses the exposure
The company reports up to 902,576 externally reachable records and says it has sent notices to potentially affected people whose contact details it holds.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Paiza’s November 13 noticePrimaryDetails the access gap, possible scope, network change, notification and follow-up measures.