> JapanHacked_
[Contained][Severity: Moderate][Credential abuse]

Cacco: X-log mail service credentials abused to send unwanted mail from its domains

Credentials for the mail service used by its X-log ad fraud tool were abused, and unintended mail may have gone out from its domains from 8 to 13 October.

Disclosed

2026-10-29

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

While checking its systems over the PHP flaw, Cacco Inc. found that credentials for the mail service used by X-log may have been used by a third party. From 8 to 13 October, mail from addresses at cacco.co.jp and teppekipack-phishing.com may have gone to recipients it did not intend. [1]

Impact

No personal data leak or intrusion into the X-log system has been found, and its other services are not affected, the company says. [1]

Response

It revoked and reissued the related credentials, including those for the mail service, and restricted the senders. People who received unexpected mail from these domains in that period are asked to delete it without opening links or attachments. [1]

Timeline

  1. Disclosed 2026-10-29
  2. 1 days

Attack or cause

Method
[Credential abuse]
Impact
Entry point
Stolen credentials

Data exposed or at risk

–

Services hit

Organizations involved

  • [Breached][Moderate]Tokyo, MinatoInformation and communications

    Cacco Inc.

    Credentials for the mail service used by X-log may have been used by a third party. No personal data leak or system intrusion has been found.

Sources

  1. [1][Official]当社ドメインを送信元とする不審なメールに関するお詫びCacco · 2026-10-29