Japan Post: unauthorized access to the web service for international mail inquiries
On September 25 Japan Post said the server of its web service for international mail inquiries had been accessed from outside without authorization, and stopped the service. Its update on October 16 said names, addresses, phone numbers and email addresses of senders and recipients, tracking numbers and more in about 600 registrations could be viewed by third parties; whether anyone viewed them is not known. The service's mail account was also used to send spam, about 520,000 messages from mid-July to September 25 according to Kyodo News. The registered data was not used as spam recipients, the company said.
Disclosed
2026-09-25
Organizations involved
1
Leaked or at risk
600
600
Downtime
Unknown
Timeline
- Detected, Disclosed 2026-09-25
- 1 days
Attack or cause
- Method
- [Intrusion]
- Impact
- [Data leak]
- Entry point
- Unknown
Data exposed or at risk
Organizations involved
[Breached][Major]Tokyo, ChiyodaTransport and postal services600 leaked
Japan Post Co., Ltd.About 600 registrations for international mail inquiries; about 520,000 spam messages sent from the service account.
Sources
- [1][Official]調査請求Web受付サービスへの不正アクセス等の発生についてJapan Post · 2026-09-25
- [2][Official]調査請求Web受付サービスへの不正アクセスなどの発生についてJapan Post · 2026-10-16
- [3][News]日本郵便から迷惑メール52万通 不正アクセス、削除要請Kyodo News · 2026-10-16
- [4][News]日本郵便に不正アクセス、「調査請求ウェブ受付サービス」のアドレスから52万件の迷惑メール送信The Yomiuri Shimbun · 2026-10-16
- [5][News]日本郵便、スパムメール52万通送信 不正アクセスで、削除呼びかけThe Asahi Shimbun · 2026-10-16