Yamato Transport disclosed the unauthorised access incident and announced that approximately 5.26 million records of user information from its Kuroneko Cash on Delivery Service had been leaked. After announcing the incident in late September, it temporarily suspended the service and resumed operations on 9 October, stating that a secure environment had been established.
In its announcement on 16 October, Yamato Transport confirmed unauthorised access by a third party to its Kuroneko Cash on Delivery Service and disclosed that the affected information included users' personal information. The leaked information comprised approximately 5.26 million user records, approximately 50,000 delivery destination records and approximately 4,100 merchant records. Yamato Transport became aware of the unauthorised access on 28 September, announced the incident on 29 September, suspended the service from the same day, and resumed operations at 13:00 on 9 October, stating that a secure environment had been established.
Some of the information included data for internal management purposes, but no credit card or password information was leaked. The company also said it had not confirmed any unauthorised removal of billing amounts, outstanding receivables or employee names. It plans to contact affected individuals in stages, but said that a public announcement would serve as notification where contacting them is difficult.
No secondary damage from unauthorised use has been confirmed at this point, although inquiries have been received about suspicious emails, SMS messages and telephone calls. The company is warning people to exercise caution regarding communications they do not recognise. Yamato Transport said it would continue strengthening its information security framework through medium- to long-term measures.