[Contained][Severity: Critical][Intrusion]

Yamato Transport: unauthorized access to Kuroneko deferred payment

Unauthorized access was found on 28 September and the service was stopped. The fourth report on 16 October confirmed that about 5.31 million records (5.26 million buyers and 50,000 delivery addresses) and data on about 4,100 merchants were taken. No card data or passwords.

Disclosed

2026-09-29

Organizations involved

4100

Leaked or at risk

5.3M

5,310,000

Downtime

Unknown

Timeline

Detected 2026-09-28
Disclosed 2026-09-29
1 days

Attack or cause

Method: [Intrusion]
Impact: [Data leak]
Entry point: Unknown
Affected, as stated: 4,100

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address][Purchase history]

Organizations involved

[Breached][Critical]Tokyo, ChuoTransport and postal services5,310,000 leaked
Yamato Transport Co., Ltd.

						Note
Yamato Transport Co., Ltd.	[Breached]	[Critical]	Tokyo, Chuo	Transport and postal services	5,310,000

Open in organization search

Sources

[1][News]ヤマト運輸、個人情報約531万件が流出　不正アクセス受けNikkei · 2026-10-16
[2][News]ヤマト運輸の後払いサービスに不正アクセス、約531万件の個人情報が流出Business+IT