Yamato Transport is Japan's largest parcel carrier. The company has confirmed that an unknown third party broke into its Kuroneko Daikin Atobarai (Kuroneko Deferred Payment) service and took about 5.26 million customer records. The figure comes from the fourth incident report, published on October 16, 2026 by parent company Yamato Holdings, and ASCII.jp's English coverage gives the same number. Around 490,000 of those records include email addresses. About 50,000 delivery address records and about 4,100 merchant records were also taken. The data covers transactions from October 2018 to the day of the intrusion. Yamato says the stolen data does not include credit card details or passwords, and that it has seen no misuse of the data so far. It has not said how the attacker got in, and no threat actor has claimed the attack.
What Happened
All dates below are in 2026. The timeline is drawn from Yamato's own notices and from secondary coverage:
- September 28 (Monday): Yamato confirmed unauthorized access to the pay-later service. It restricted outside access and shut the service down at 22:28 that day. Yamato's own notice and secondary reports (zephel01 on note, WP Mamoru, Japan Cyber Watch) agree on this. TA-Q-BIN parcel delivery and Yamato's other services kept running normally.
- September 29: First public notice. Yamato said it had reported the incident to Japan's Personal Information Protection Commission and brought in an outside security firm to investigate.
- October 2: Second report. Yamato listed the data that may have leaked: names, addresses, phone numbers, email addresses, billed amounts, outstanding balances, item details, merchant information, and the names of Yamato employees who handle the service.
- October 9: Third report. Japan Cyber Watch reports that the service restarted at 13:00 JST. Payment deadlines falling on or after September 28 were pushed back by 17 days.
- October 16: Fourth report, with the investigation's findings. Yamato confirmed that data had actually been taken and narrowed down which fields were involved.
Merchants were hit directly. Retailer Aena, which offered the service in its official app, had to turn off pay-later checkout. It also told customers that Yamato had stopped sending its postcard invoices during the outage. Aena says it has found no sign of a leak from its own systems.
The breach also fell within a busy stretch for Japanese companies. Between September 25 and 30, Japan Post and Sagawa Express also disclosed unauthorized access, according to zephel01 on note. The Aikido Community blog adds that Seicomart, Times Car and Nippon Rent-A-Car disclosed incidents around the same time. Aikido Community itself says there is no evidence that one attacker was behind all of them, and no shared vulnerability has been confirmed.
What Was Taken
Yamato's fourth report lists three categories of stolen data:
| Data set | Period covered | Volume |
|---|---|---|
| Customer records: name, address, phone, email, item details (product, quantity, unit price), internal data (application number, order date, credit screening number) | Oct 1, 2018 to Sep 28, 2026 | ~5.26M (about 490,000 include an email address) |
| Delivery address records: recipient name, address, phone, waybill number | Feb 5, 2021 to Sep 28, 2026 | ~50,000 |
| Merchant records: merchant name, merchant code | Oct 1, 2018 to Sep 28, 2026 | ~4,100 |
The headline figure of about 5.26 million is the same in Yamato's notice and in ASCII.jp's report. None of the sources gives a different number. Yamato counts records, not people, so the number of unique individuals affected is probably lower. Yamato has not published a count of individuals.
Where the accounts differ: Several earlier reports, all based on Yamato's October 2 notice, said billed amounts, outstanding balances and employee names were exposed. These include Japan Cyber Watch, Aena's customer notice and the Aikido Community analysis. The fourth report reverses this. Yamato now says its investigation found no confirmed exfiltration of billed amounts, outstanding balances or employee names. Coverage written before October 16 is therefore out of date on those points. Yamato's final findings take precedence.
The data is not financial, but it is still sensitive. Linking a name, home address and phone number to what a person bought and the fact that they used a pay-later scheme is very useful to fraudsters. Waybill numbers and merchant names make fake delivery or payment messages more convincing.
Why It Matters
- Fraud risk to customers: Yamato says it has already received calls about suspicious emails, texts and phone calls. It has not tied them to this breach. Japan already sees a constant stream of phishing that pretends to come from Yamato. With real order details, scammers can send fake "unpaid invoice" messages that look genuine. A pay-later scheme is an easy target for this, because customers expect to receive a bill after delivery.
- Merchants pay the price too: The Aena case shows that when a payment provider shuts down, the merchant loses a checkout option and has to deal with customer questions about an incident it did not cause. WP Mamoru makes the same point to small online shops: the store's own site may be fine, but checkout still fails when the payment provider goes offline.
- Eight years of data in reach: The stolen data goes back to 2018. That points to a retention problem: an internet-facing payments service could reach nearly eight years of historical records.
- No details on the cause: Yamato has not disclosed the cause. A roundup of 11 recent Japanese incidents from innovaTopia notes that Yamato's is one of the cases where the point of entry has not been made public. That leaves other organizations with nothing concrete to check for.
The Attack Technique
Not disclosed. Yamato has not named a vulnerability, a product or an initial access method. No group has claimed the attack, and none of the sources gives any attribution.
The only discussion of method is speculation from the Aikido Community blog, and it should be read as hypothesis. The author notes that the stolen data matches what the pay-later application would normally handle, while card data and passwords were not touched. From that, they suggest the attacker may have read data through the application's own legitimate paths rather than gaining free access to the whole database. The author is clear that public information cannot show whether that boundary came from access controls or simply from how the data was split across systems. In Japan, card data commonly sits with the payment processor and passwords sit on a separate login system.
Most of the other incidents in the September cluster also started at internet-facing business applications. These include inquiry forms, pay-later checkout, parcel tracking, member apps and booking systems. Aikido Community argues that attackers can map these quietly using DNS records, TLS certificates, public JavaScript, mobile apps and old URLs, without loud port scanning.
What Organizations Should Do
- Inventory every internet-facing business application. Include the less visible ones, such as inquiry forms, tracking pages, member APIs and payment back-ends. List the data each one can reach. Then search for them the way an attacker would, using certificate transparency logs, DNS records and endpoints exposed in your apps' JavaScript and mobile code.
- Limit what each application can read. Separate data stores and give each application account only the access it needs. Card data, login credentials and analytics history should not be reachable from a customer-facing service. Retention matters too: a live payments system rarely needs eight years of order history online.
- Watch for unusual bulk reads through normal application paths. Set baselines for query volume and record counts per account and per API key. Alert when one session pulls historical data in bulk, even if every individual request looks valid.
- Plan for a payment or logistics provider going down. Know which checkout, delivery and form features depend on outside providers. Have a way to hide a disabled payment option quickly and a customer notice ready to publish. After a provider breach, rotate the API keys and webhook secrets you share with that provider.
- Prepare for follow-on phishing. If your customers used Kuroneko pay-later, warn them that neither you nor Yamato will ask for card numbers or passwords. Tell them to ignore links in unexpected "payment overdue" messages. Make sure your brand's email sender authentication (DMARC enforcement) is in place.
- Publish findings in stages and correct early claims. Yamato's fourth report narrowed down the second report's list of possibly exposed data. This approach is reasonable, but the correction needs to be stated clearly and repeated, or out-of-date figures keep circulating in coverage.
Sources: Yamato Transport: Approximately 5.26 Million Customer Records Leake... | Three major delivery companies announced unauthorized access within... | 最近の不正アクセスのパターンから読む — 攻撃開始が見えない「静かな侵入」 Aikido Community | 【解説】ムラウチドットコム771万件・東洋紡・ヤマトなど国内サイバー事案11件を入口別に整理 | ヤマト運輸の後払いサービスに不正アクセス｜WordPressの決済連携を今日確認する3点 – WP守る | Yamato Transport Data Breach: Kuroneko Pay-Later Customers' Address... | 【第4報】「クロネコ代金後払いサービス」への不正アクセスに関する調査結果と今後の対応について ヤマトホールディングス株式会社 | 【続報】「代金後払い決済」に関するお知らせ ― アエナを装った不審な連絡にご注意ください ニュース 株式会社アエナ