Rakus Light Cloud is the subsidiary of Tokyo-listed Rakus that runs the Japanese email newsletter platform Blastmail (ブラストメール). Some sources romanise the name as "RAKUS Lite Cloud". The company has confirmed that an unidentified attacker took records for every Blastmail contract holder. For a subset of customers, the attacker also took the newsletter subscriber lists those customers kept on the platform. The confirmed count of contracts with leaked delivery data has grown with each update. Giftee, citing the operator, reported 288 contracts as of 14:00 JST on 23 October. Rescana and ITD both report 344 in the 24 and 25 October updates. Rakus Light Cloud says the number may change again as an outside investigation continues. Blastmail has been offline since 21 October. Downstream organisations are now telling their own subscribers about the exposure, and the largest single disclosure so far covers just over one million email addresses.
Every source available for this brief is secondary or a downstream customer notice. None is Rakus's own statement. Where the sources disagree, this brief says so and names the source.
What Happened
- 21 October, about 00:30 JST: Rakus Light Cloud detected suspicious access and shut down Blastmail as an emergency step. Rescana reports that mail delivery stopped at about 01:00 JST. The admin console and API remain unavailable, and the company has not given a restart date.
- 21 October: Parent company Rakus published two notices. The first reported the detection and the shutdown. It also said the incident had been reported to Japan's Personal Information Protection Commission (PPC) and to JIPDEC, and that no other Rakus services were affected (per NEXSIGHT). The second notice confirmed that data had been taken.
- 22 to 24 October: Customer organisations began publishing their own notices. ITmedia lists Yokohama City, JR Shikoku, Niigata Nippo, H.I.S. Hotel Holdings, Tohoku Electric Power Frontier, Kurashicom, Giftee, Nulab and JAPEX. Piccoma and Sakurasaku Marketing published their own notices as well. Rescana reports that Japan's Ministry of the Environment has said lists for six newsletters connected to the ministry may have leaked, but that no leak has been confirmed.
- 25 October, 10:00 JST: In its latest update, as reported by Rescana, Rakus Light Cloud said it had confirmed leaks for 344 contracts and had contacted each of them individually. The next update is expected around 10:00 JST on 26 October.
What Was Taken
From the sales-management system, covering all Blastmail contract holders: - company names - contact names - phone numbers - email addresses - billing email addresses - contract and payment history
The company says it does not store credit card numbers. ITmedia goes further and states flatly that card numbers were not leaked.
From the service database, covering some customers: Rakus describes this data as subscriber lists and other information about mail delivery. What each list contained depends on what the sending organisation uploaded. Publicly disclosed impact so far:
| Organisation | Records | Data | Status |
|---|---|---|---|
| Piccoma | 1,002,404 | Email addresses only | Confirmed by the operator on 24 Oct |
| Niigata Nippo | Up to ~253,000 | Name, municipality, email, gender, age band, subscriptions | Reported as leaked (ITmedia) |
| H.I.S. Hotel Holdings | ~140,000 | Name, email | Possible |
| Tohoku Electric Power Frontier | Up to ~100,000 | Email, internal ID | Possible |
| JR Shikoku | Up to ~30,000 | Name, date of birth, address, email | Possible |
| Yokohama City | 6,334 | Name, email of Expo 2027 volunteer applicants | Possible |
| Sakurasaku Marketing | Entire subscriber list | Exact fields not yet known | Confirmed |
| Giftee | n/a | IDs, emails, corporate login URLs | Possible. Giftee says it is not among the 288 confirmed contracts |
No source gives a total number of affected subscribers across all customers. Several notices describe a leak as possible but not confirmed, so the true scope is still unclear.
Why It Matters
This is a supply-chain breach in the plainest sense. One compromise of a shared SaaS platform has exposed people who have never heard of Blastmail. The two data sets make each other more dangerous. An attacker now holds each customer's identity and billing contacts, the subscribers who expect mail from that customer, and in some cases the subscribers' names, dates of birth and addresses. With that combination, an attacker can write very convincing phishing in either direction. They could send fake renewal or re-login emails to Blastmail customers, or newsletters that look genuine to subscribers. Corporate login URLs in Giftee's data, and personal details in the JR Shikoku and Niigata Nippo lists, make targeted lures easier still.
The outage also has a direct operational cost. Sakurasaku Marketing says it cannot even see which of its subscribers were affected, or email them through the platform, until the operator extracts the data. It expects that to happen next week at the earliest. Many Japanese data controllers also face their own reporting duties to the PPC. ITD reports that applications to join a joint report close on 29 October.
The Attack Technique
Rakus says the attacker broke into two Blastmail API servers and ran commands on them. From those servers, the attacker connected to both the sales-management system and the service database and pulled data out. In other words, servers facing the internet had enough network access and credentials to reach the company's back-office customer records and its customer data stores.
How the attacker first got in has not been disclosed. No threat actor has been named, and no source reports a ransom demand or a leak-site listing. ZeroKai discusses Blastmail alongside the separate NEC subcontractor intrusion, in which stolen contractor credentials were used. However, no source says that Blastmail was compromised the same way, and the two incidents should not be treated as linked.
What Organizations Should Do
- If you sent mail through Blastmail, confirm with Rakus Light Cloud ([email protected]) whether your contract is among those notified. Decide this week on PPC reporting and on notifying affected individuals, and keep in mind the reported 29 October joint-report deadline.
- Stop Blastmail from sending mail as your domain. Piccoma, for example, changed its settings so that mail sent through Blastmail is no longer treated as genuine Piccoma mail. Remove Blastmail from SPF, revoke any DKIM keys delegated to it, and enforce DMARC at quarantine or reject.
- Warn your subscribers before attackers reach them. Tell them you will never ask for passwords or payment details by email, and send the warning through a channel separate from the affected list.
- Brief finance and procurement staff to expect fake Blastmail or Rakus invoices, payment-change requests and re-login prompts. Billing contacts and payment history are now in the attacker's hands.
- Rotate API keys and integration credentials for any system that synced lists to Blastmail. Check for login URLs or IDs that were included in exported lists.
- Review your own SaaS architecture. API servers that can reach billing systems and full customer databases give an attacker a large blast radius. Segment them, use credentials with the least access needed, and alert on unusual database pulls coming from application tiers.
Sources: Blastmail Breach: Rakus Light Cloud Confirms Customer Records and S... | blastmail Data Breach (October 2026): RAKUS Lite Cloud, Affected Or... | When a contractor's legitimate account is the way in: what the NEC... | メール配信「ブラストメール」に不正アクセス、全契約者の会社名・連絡先など外部持ち出し — ラクスが第2報、サービス停止中 NEXSI... | 【続報】株式会社ラクスライトクラウドで発生した不正アクセスに伴う個人情報漏えいの可能性について（2026年10月23日（金）追記）... | 株式会社ラクスライトクラウドのメール配信システム「ブラストメール」への不正アクセスによるお客様のメールアドレス流出に関するお知らせとお... | 【重要】第二報ブラストメール情報漏洩に関して｜サクラサクマーケティング株式会社 | メール配信サービスの契約者情報全て漏えい 横浜市やJR四国などに影響 ラクス子会社に不正アクセス - ITmedia NEWS