Blastmail operator ラクスライトクラウド announced on 21 October 2026 that two API servers had been accessed without authorization and data had been exfiltrated. Subscriber information and parts of recipient lists may have been leaked, and the service has been suspended.
A monitoring alert was detected on the night of 20 October 2026, and the unauthorized access originating from two API servers and the exfiltration of information were disclosed on 21 October. The affected data includes subscribers' company names, contact information and payment histories, while parts of recipient lists may also have been leaked. The admin console and API have been suspended, and distribution functionality remains unavailable.
According to the official announcement, the potentially leaked data covers information relating to all subscribers and recipient lists belonging to some subscribers. Individual notices have been completed for the 345 contracts identified as affected. The types and scope of information differ by subscriber.
Additional disclosures through 4 November included Northmall, Xserver and Medianavi, with each company announcing the number of leaked records and the data items involved. Login credentials and credit card information are not included, and the internal investigation is ongoing.
The official disclosures continue to be compiled and updated, and further announcements of affected parties and additional information are expected.