Ymirlink, the Tokyo-listed company behind the Cuenote email-delivery service, says hackers took data from five of its systems. It estimates a cumulative total of about 9 million records, including email addresses, were extracted. The company disclosed the breach on 19 October and says its investigation is still at an early stage.
The breach matters well beyond Ymirlink itself. Cuenote is used by businesses and other organisations to send email to their own customers and members. That means the people whose addresses were taken may never have dealt with Ymirlink directly, and may not yet know their details are involved.
In brief
- Ymirlink estimates a cumulative total of about 9 million records, including email addresses, were taken from five Cuenote FC systems.
- The attacker exploited a program flaw, took staff credentials and planted a malicious program to pull data from databases, the company says.
- The figure counts records, not people, and Ymirlink has not named which client organisations were affected.
How the attacker got in
In its timely disclosure to the Tokyo Stock Exchange, labelled a “first report” (第一報), Ymirlink says a member of staff found the unauthorised access in the early hours of Friday 16 October, Japan time. Its access logs, the company says, show a four-step attack.
First, the attacker used a vulnerability in a program. That gave them the service login credentials of Ymirlink’s own support and quality-control staff. They then installed a malicious program and used it to output data from a database, and finally tried those staff credentials on other systems.
Ymirlink says it disconnected the affected servers from the network straight away. It also wrote and applied a fix for the vulnerability, deleted the support staff’s credentials from other systems and improved its ability to detect malicious programs. It has reported the case to investigators and is working with outside experts.
What the 9 million figure means
The headline number needs careful reading. Ymirlink’s Japanese wording is “延べ約900万件”, which translates as a cumulative total of about 9 million items of information. That is a count of records across five systems, not of unique people. The same person could appear more than once, for example on the lists of several different client organisations.
The company also describes it as an estimate (試算). It says details of the extracted data are still under investigation, and it confirms only that the data includes email addresses. An updated notice on the Cuenote website, posted at 19:05 Japan time (11:05 UK time) on 19 October, adds that the five affected systems all belong to the dedicated ASP plan of its Cuenote FC email-delivery service.
That detail narrows the scope but leaves the key question open. Ymirlink has not said which customer organisations use those five systems, or how many individuals are behind the 9 million records. It says it will publish further reports as facts emerge. It is also reviewing the impact on its results for the financial year ending December 2026.
Part of a busy day for Japanese breach notices
Ymirlink was not the only Japanese organisation to disclose an intrusion on 19 October. According to Kyodo, as published by the Mainichi, the trade agency JETRO, Hankyu Hanshin Department Stores, 2nd Retailing, Joshin, Trustbank and a Toho Holdings subsidiary all reported unauthorised access the same day. Kyodo described Ymirlink’s data as information that “may have leaked”.
None of the organisations has said the incidents are connected, and no common attacker has been named. Kyodo also reported comments from Trend Micro chief executive Eva Chen, who said stolen personal information can be sold by fraud groups and used in phishing emails or as a pathway for new breaches. She added that artificial intelligence is being used to facilitate cyberattacks.
TSN has tracked a run of large Japanese disclosures this year, including Burger King Japan, Yamato Transport and Nikkei.
Our read
This is TSN’s analysis. An email-delivery provider holds other companies’ customer lists, so a breach here is a classic third-party risk. The organisations that collected the data are still responsible for it, even though they did not run the systems. For readers, the practical risk is phishing: anyone who receives an unexpected message about Cuenote, a delivery or an account problem should check the sender carefully before clicking.
The next step is Ymirlink’s second report. Until it names the affected clients and gives a count of individuals, most people on those lists will not know whether their address is among the 9 million records.
Sources
- Ymirlink: 当社システムへの不正なアクセスに関するご報告（第一報）, TDnet timely disclosure, 19 October 2026
- Cuenote: 当社システムへの不正なアクセスに関するご報告（第一報 19:05更新版）, 19 October 2026
- Kyodo via the Mainichi: Japan trade agency, Japanese firms face unauthorized access, 20 October 2026
Related stories
- Japan’s Data-Breach Wave: What Bookoff, Times Car, skyticket, Lawson, Resorttrust and Others Have Admitted
- Nikkei Says 1.83 Million Personal Data Items Leaked From a Development Cloud
- Yamato Transport Says About 5.26 Million Pay-Later Customer Records Were Taken
- Burger King Japan Says About 11.18 Million App Member Records Leaked After Unauthorised Access
- Japan’s Commune Confirms About 307,000 Community Members’ Data Leaked; Sansan and Panasonic Say Their Forums Were Hit
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
