Following unauthorized access to Blastmail, the email delivery service used by Broadleaf’s Monozukuri.com, the email recipient list was removed from the system and taken outside the company. The number of affected individuals and the specific information involved are still under investigation, while the distribution function remains suspended.
On 23 October 2026, Broadleaf announced that unauthorized access to Blastmail, the email delivery service used by its Monozukuri.com website, had resulted in the email recipient list being removed from the system and taken outside the company. The specific contents of the list and the number of affected individuals are still under investigation, and the announcement did not state that the website’s own systems had been accessed without authorization.
According to publicly available materials, the advertising media kit for Monozukuri.com lists approximately 50,000 registered members. This figure refers to the website’s membership and does not indicate the overall scope of the distribution data. The actual number of individuals affected by the leak will be determined after further investigation.
The attackers who breached 2 servers used for Blastmail’s API are said to have taken out data including contract information and some recipient lists. Leakage of distribution information has been confirmed for 345 contracts. The distribution function remains suspended, with resumption targeted for around 11 November, although this may change depending on the investigation’s findings.
Broadleaf is working with Raksul Light Cloud to examine the affected data in detail and plans to disclose any additional information through its corporate website and other channels. The impact of this incident will be treated as part of the same event and will not be counted redundantly as a separate number of attacks.