Report on Unauthorized Access to Our Systems (Third Report)
YMIRLINK,Inc. (the filing company)
Cuenote FC email delivery service, Cuenote BASE customer management system, Cuenote SR-S email delivery engine, Cuenote SMS, Cuenote Auth, Cuenote Survey, Cuenote Push, and a safety confirmation service. Information leakage was confirmed for Cuenote FC and Cuenote BASE.
Exploitation of program vulnerabilities and other weaknesses, misuse by the attackers of valid session information stolen from the initial compromise point, and unauthorized access to legitimate administrative screens to misuse the CSV export function and download data.
Company response
Some systems within the dedicated ASP environment for Cuenote FC have been taken offline for a forensic investigation by an external specialist organization. The response for Cuenote BASE has been completed, but operations remain suspended.
A forensic investigation by an external specialist security organization. Final analysis is in progress; the organization's name, chairperson's name, and establishment date are Not disclosed.
1. Fundamental strengthening of secure coding and vulnerability management: implementing rigorous input validation for file access processing and other functions, revising design and review standards, introducing source code reviews using AI and automated detection of potential vulnerabilities, and introducing regular third-party vulnerability assessments by external specialist organizations. 2. Zero-trust privileged access management and maintenance operations: eliminating shared administrator privileges permanently maintained within systems, and establishing and operating least-privilege access only when executing tasks through a secure gateway based on multi-factor authentication. 3. Establishing 24/7/365 monitoring and rapid incident response through defense in depth: deploying systems to monitor anomalies across all server environments, issuing alerts for suspicious file placement, conducting continuous checks 24/7/365 through a dedicated monitoring structure, and operating a response process that acts as soon as a threat occurs.
Fiscal year ending December 2026 (the impact on results is currently under review)
The impact of this matter on results for the fiscal year ending December 2026 is currently under review. The company plans to promptly disclose any matters that arise requiring further disclosure.
Related procedures
Filing a damage report with the police station having jurisdiction and cooperating with the investigation, and making reports and completing procedures with the Personal Information Protection Commission, JIPDEC, and IPA
Metropolitan Police Department Cyber Incident Reporting Desk, police station having jurisdiction, Personal Information Protection Commission, Japan Institute for Promotion of Digital Economy and Community (JIPDEC), and Information-technology Promotion Agency, Japan (IPA)
The company will proceed with the final analysis of the forensic investigation by the external specialist security organization and will summarize the investigation results once it has received the organization's investigation report.
Upon receiving the investigation report, the company plans to publish a further report, designated the "Final Report," summarizing the investigation results.
| Item | Details |
|---|---|
| Event name | Report on Unauthorized Access to Our Systems (Third Report) |
| Date of occurrence | 16 October 2026 (06:49, the date on which a company employee detected an anomaly in their own account on the operations management system) |
| Date recognized / date notice received | 16 October 2026 06:49 (company employee detected the anomaly) |
| Subject Entity | YMIRLINK,Inc. (the filing company) |
| Target Locations / Products | Cuenote FC email delivery service, Cuenote BASE customer management system, Cuenote SR-S email delivery engine, Cuenote SMS, Cuenote Auth, Cuenote Survey, Cuenote Push, and a safety confirmation service. Information leakage was confirmed for Cuenote FC and Cuenote BASE. |
| Cause | Exploitation of program vulnerabilities and other weaknesses, misuse by the attackers of valid session information stolen from the initial compromise point, and unauthorized access to legitimate administrative screens to misuse the CSV export function and download data. |
| Accounting period in which recognized | Fiscal year ending December 2026 (the impact on results is currently under review) |
| Impact on Earnings Forecast | The impact of this matter on results for the fiscal year ending December 2026 is currently under review. The company plans to promptly disclose any matters that arise requiring further disclosure. |
| Type of litigation or proceeding | Filing a damage report with the police station having jurisdiction and cooperating with the investigation, and making reports and completing procedures with the Personal Information Protection Commission, JIPDEC, and IPA |
| Court or authority | Metropolitan Police Department Cyber Incident Reporting Desk, police station having jurisdiction, Personal Information Protection Commission, Japan Institute for Promotion of Digital Economy and Community (JIPDEC), and Information-technology Promotion Agency, Japan (IPA) |
| Suspended operations | Some systems within the dedicated ASP environment for Cuenote FC have been taken offline for a forensic investigation by an external specialist organization. The response for Cuenote BASE has been completed, but operations remain suspended. |
| Investigation structure | A forensic investigation by an external specialist security organization. Final analysis is in progress; the organization's name, chairperson's name, and establishment date are Not disclosed. |
| Measures to prevent recurrence | 1. Fundamental strengthening of secure coding and vulnerability management: implementing rigorous input validation for file access processing and other functions, revising design and review standards, introducing source code reviews using AI and automated detection of potential vulnerabilities, and introducing regular third-party vulnerability assessments by external specialist organizations. 2. Zero-trust privileged access management and maintenance operations: eliminating shared administrator privileges permanently maintained within systems, and establishing and operating least-privilege access only when executing tasks through a secure gateway based on multi-factor authentication. 3. Establishing 24/7/365 monitoring and rapid incident response through defense in depth: deploying systems to monitor anomalies across all server environments, issuing alerts for suspicious file placement, conducting continuous checks 24/7/365 through a dedicated monitoring structure, and operating a response process that acts as soon as a threat occurs. |
| Outlook | The company will proceed with the final analysis of the forensic investigation by the external specialist security organization and will summarize the investigation results once it has received the organization's investigation report. |
| Planned follow-up disclosure | Upon receiving the investigation report, the company plans to publish a further report, designated the "Final Report," summarizing the investigation results. |
Items this document does not state (10)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.In addition to exploiting program vulnerabilities, the attackers misused valid session information they had stolen, accessed legitimate administrative screens, and used the CSV export function to remove the data.