Yamato Transport, Japan’s largest parcel delivery company, says attackers took about 5.26 million customer records from its “Kuroneko pay-later” service, a payment option for online shoppers. Delivery-recipient and merchant records were also taken. The company says no credit card data or passwords were involved and no misuse has been confirmed so far.
The quotes below are TSN’s translations from Japanese.
What Yamato found
In a fourth report published on 16 October, parent company Yamato Holdings said Yamato Transport confirmed on Monday 28 September that the Kuroneko pay-later service had suffered “unauthorised access by a third party”. The service lets customers receive goods ordered online first and pay later using a payment slip. Yamato says it quickly restricted outside access and reported the incident to Japan’s Personal Information Protection Commission.
An investigation carried out with outside security specialists found that “some information relating to the Kuroneko pay-later service was taken without authorisation”, the company said. Yamato did not say how the attackers got in or who they were.
What was taken
Yamato lists three groups of data:
- Customer information, about 5.26 million records, covering 1 October 2018 to 28 September 2026: names, addresses, phone numbers, email addresses, item details (product names, quantities and unit prices) and internal management data such as application numbers, order dates and credit-check numbers. About 490,000 of these records include an email address.
- Delivery-recipient information, about 50,000 records, from 5 February 2021 to 28 September 2026: recipients’ names, addresses, phone numbers and waybill numbers.
- Merchant information, about 4,100 records: merchant names and internal merchant codes.
“Credit card information and password information are not included,” Yamato says. Its earlier second report had flagged that billing amounts, outstanding balances and Yamato employees’ names might be involved. The investigation found no evidence those were taken.
Japanese media including Jiji Press have reported the total as 5.31 million sets of data, which is the sum of the three groups. The 5.26 million figure is Yamato’s count for customer records alone.
Warnings about scams
“At present, no secondary damage caused by misuse of the information has been confirmed,” Yamato says. However, it says it has received enquiries from people who got suspicious emails or text messages from unknown senders, or suspicious phone calls.
The company urges anyone who receives a suspicious email or SMS not to click links or open attachments, and to delete the message straight away. It also advises caution with unexpected calls or post. Because the leaked data combines names, addresses, phone numbers and recent purchases, it could be used to make scam messages look convincing.
Yamato says it will contact affected people individually. Where that is not possible, for example because registered details have changed, the published report serves as notification.
Service and next steps
The pay-later service was suspended after the attack and resumed on 9 October, according to Yamato’s third report and Yomiuri Shimbun. Yamato says it will strengthen its information security with medium- to long-term measures on the advice of outside experts.
The incident adds to a run of large data breaches disclosed by Japanese companies in recent weeks. On the same day, Jiji reports, publisher Nikkei Inc. gave details of its own leak.
What we don’t know
- How the attackers got into the service, and whether a ransom was demanded.
- Who was responsible. No group has been named.
- Whether any of the data has been published or sold.
What this means
- Yamato Transport says about 5.26 million Kuroneko pay-later customer records from October 2018 onwards were taken, plus about 50,000 delivery-recipient and 4,100 merchant records.
- No card data or passwords were involved, and Yamato says no misuse has been confirmed.
- Customers should watch for scam emails, texts and calls that use their name, address or order details.
Sources
- Yamato Holdings: 4th report on unauthorised access to the Kuroneko pay-later service (Japanese)
- Jiji Press: More Japanese firms disclose details of data breaches
- Yomiuri Shimbun: Yamato Transport announces leak of about 5.3 million customer records (Japanese)
Related stories
- Japan’s Data-Breach Wave: What Bookoff, Times Car, skyticket, Lawson, Resorttrust and Others Have Admitted
- Nikkei Says 1.83 Million Personal Data Items Leaked From a Development Cloud
- Kirin’s FANCL and ATENEA Say Online Shop Data on About 785,000 People Leaked
- JR East and Viewcard Say About 6.09 Million Accounts May Be Exposed After the IDC Frontier Attack
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
