An unauthorized access incident involving Yamato Transport's Kuroneko Deferred Payment Service resulted in the leakage of approximately 5.31 million records of internal management information, including names, addresses, telephone numbers and email addresses. Credit card information and passwords were not included.
On 16 October, Yamato Transport published the results of its investigation into unauthorized access and announced that some customer information relating to users of its Kuroneko Deferred Payment Service had been leaked. The leaked information consisted of internal management data such as names, addresses, telephone numbers, email addresses, product details and application numbers. The total was approximately 5.26 million records, or approximately 5.31 million records overall. Approximately 490,000 records included email addresses.
The leakage also included approximately 50,000 records of names, addresses, telephone numbers and waybill numbers for some delivery recipients, covering shipments since February 2021, and approximately 4,100 records of merchant information, covering information since October 2018. The company said it had not confirmed the leakage of billing amounts, outstanding receivables or the names of its employees. The leakage period was from 1 October 2018 through 28 September 2026, and the company said it would contact affected users in succession.
In response to the incident, the company stated that it would strengthen its information security framework over the medium to long term, with advice from external specialists. Although no secondary damage has been confirmed at this time, the company is urging customers to respond cautiously to suspicious emails and SMS messages. It also explained that, where individual notification is difficult, this announcement would serve in place of direct notification.