[Investigating][Severity: Critical][Credential abuse]

Shippio: trade logistics platform breached; all customers' company data and about 1,300 documents taken, service stopped

Credentials from an internal tool were used to break into Shippio's logistics platform; all customers' company data was viewed and about 1,300 documents taken.

Disclosed

2026-11-04

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

Files exposed or at risk

1.3K

1,300

Accounts affected or at risk

1.1K

1,100

What happened

2026-10-30
Unauthorized access to an internal business tool began, and credentials stored in it were used. [1]
2026-11-01
From 19:30 until 17:00 the next day, the Shippio platform was accessed without authorization several times. [1]
2026-11-02
It stopped the service at 10:40. [1]
2026-11-04
It disclosed the breach. [1]

Impact

Every customer's company name, team name, phone number and address, and nearly all shipment data, were viewed. About 1,300 document files were downloaded, and some internal shared files were taken. User names and email addresses may also have leaked. It says it does not store passwords. [1]

The attacker created fake accounts and API credentials for about 1,100 teams, changed settings and uploaded malicious files. [1]

The company reports unauthorized users or integration credentials created for about 1,100 contracted team accounts and about 1,300 files downloaded. These are team-account and file counts, not a count of leaked personal records. Downloaded files also contained personal information about people who were not service users. Attackers uploaded files, but there is no confirmed record of customers downloading them. [1]

Timeline

Detected 2026-11-02
Disclosed 2026-11-04
2 days

Attack or cause

Method: [Credential abuse]
Impact: [Data leak][Service outage]
Entry point: Stolen credentials

Data exposed or at risk

[Name][E-mail address][Phone number][Postal address]

Services hit

[Breached][Critical]
Shippio

Service	Role	Impact level	Note
Shippio	[Breached]	[Critical]

Organizations involved

[Breached][Critical]Tokyo, MinatoTransport and postal services
Shippio, Inc.
All customers' company names, team names, phone numbers and addresses were viewed and about 1,300 document files were downloaded. User names and email addresses may also have leaked.

						Note
Shippio, Inc.	[Breached]	[Critical]	Tokyo, Minato	Transport and postal services	Unknown	All customers' company names, team names, phone numbers and addresses were viewed and about 1,300 document files were downloaded. User names and email addresses may also have leaked.

Sources

[1][Official]【重要】当社プラットフォームへの不正アクセスによる個人情報等の漏えいおよびサービス一時停止に関するお詫びとご報告Shippio · 2026-11-04