Ymirlink, Inc. (TSE Growth: 4372) is the Tokyo-listed company behind the Cuenote email-delivery service. It has confirmed that attackers got into five systems in its Cuenote FC dedicated ASP plan and pulled data out of their databases. In a "first report" (第一報) timely disclosure dated 19 October 2026, the company estimates that about 9 million cumulative records (延べ約900万件), including email addresses, were output. Every source reviewed for this brief uses the same figure. All of them, and the company itself, describe it as a cumulative estimate that may include duplicates, not a count of affected people. Ymirlink has not named the client organisations whose mailing lists were involved. The exploited vulnerability, when the intrusion began and the exact data fields taken are all still under investigation.
What Happened
According to Ymirlink's notice on its Cuenote site, updated at 19:05 JST on 19 October, a staff member found unauthorised access on some systems in the early hours of Friday 16 October 2026, Japan time. The company reviewed the access logs and says they show the following:
- The attacker exploited a vulnerability in a program.
- The attacker obtained the service login credentials of Ymirlink's own support and quality-control staff.
- The attacker installed a malicious program and used it to output data from a database.
- The attacker used the stolen staff credentials to try to log in to other systems.
Ymirlink says it disconnected the affected servers from the network straight away. It then wrote and applied a patch for the vulnerability, deleted the support and QC staff credentials from other systems, and improved its ability to detect malicious programs. It has reported the incident to investigators and is working with outside experts. The company says it will publish more when new facts come to light. It is still assessing the impact on its results for the fiscal year ending December 2026.
Ymirlink went public three days after detection, on 19 October. zephel01's comparison of the disclosures made that day points out that Ymirlink's announcement landed on the same day as other large service-provider incidents in Japan. Those included Hankyu Hanshin Department Stores (about 1.26M records) and Nifty (up to 542,513). It was also the day Arcadia, a disaster-alert email provider, published its intrusion route.
What Was Taken
- Volume: about 9 million cumulative records across the five systems. This is Ymirlink's own estimate (試算). The company's notice and most coverage describe it as "information including email addresses." The Japan IR English summary calls it "approximately 9,000,000 email addresses." That wording is less precise than the original Japanese. TSN, zephel01, Yagura and West IT Media all stress that the count is cumulative and may include duplicates, so it should not be read as 9 million unique people or addresses. The number of unique individuals has not been published.
- Data fields: email addresses are confirmed. Ymirlink says the detailed contents of the extracted data are still under investigation. It has not said what other fields, such as names or attributes, may have been included.
- Affected systems: a total of five systems in the Cuenote FC dedicated ASP plan (専用ASPプラン). Yagura, citing ITmedia NEWS, reports that the Cuenote line has more than 2,900 system contracts. That suggests the five breached systems are a small share of the platform, but Ymirlink has not confirmed this.
- Affected clients: none have been named. Sources agree that downstream organisations will need to make their own disclosures.
Why It Matters
Cuenote FC is infrastructure that companies and public bodies use to send newsletters and notices to their own customers and members. The people whose addresses were taken may never have heard of Ymirlink, as TSN and Security Note both point out. They will probably first hear about it from a retailer or service they use, or from a phishing email that imitates one.
This is a supply-chain exposure. Client organisations handed their subscriber lists to a vendor whose systems they cannot monitor. Yagura compares it to the Arcadia incident earlier in October, where an intrusion at one delivery provider led to disclosures by 115 municipalities and organisations. A similar wave of downstream notices is likely here once Ymirlink identifies the affected tenants. In Japan, organisations that use Cuenote FC may also have to notify the people affected and report to the Personal Information Protection Commission, as Nowledge notes.
The data itself is valuable for phishing. Attackers can match real email addresses to the brands that mail them, which makes convincing impersonation easy ("apology" notices, "please confirm your account" messages). West IT Media and Security Note both warn consumers about exactly this.
The Attack Technique
Ymirlink has not named the vulnerability or the affected component. No CVE has been linked to the incident. The sequence it describes is clear, though:
- Initial access: the attacker exploited a flaw in an application program.
- Credential access: the attacker harvested service credentials belonging to Ymirlink's internal support and QC staff. These are privileged operational accounts.
- Persistence and collection: the attacker installed a malicious program on the compromised host and used it to output database contents.
- Lateral movement attempts: the attacker reused the stolen staff credentials against other systems.
The fourth step explains why the damage covers five systems rather than one. Several analyses, including Security Note, Yagura and Nowledge, identify the shared support credentials as the multiplier. Operations and support accounts that work across many customer environments turn one compromised host into a platform-wide problem. Ymirlink's response of deleting those staff credentials from other systems points the same way. The company has not said whether any of the cross-system login attempts succeeded beyond the five confirmed systems, and it has not given an intrusion start date. The dwell time is therefore unknown.
What Organizations Should Do
- Cuenote FC customers: check with Ymirlink's dedicated contact point (03-6820-0088, weekdays 09:00 to 20:00 JST, or [email protected]) whether your delivery system is one of the five. Use only the contact details in the official notice, not details from any email you receive. Prepare to notify affected people and the PPC if necessary.
- List your data processors: for every vendor that holds personal data on your behalf, record what fields and how many records they hold. Decide in advance who notifies customers and whether you will pause sending or integrations while a vendor investigates.
- Separate support and maintenance credentials: issue operational credentials per system or tenant, never shared across environments. Revoke them as soon as a person no longer needs access to a system. One stolen credential should stop at one system.
- Detect unauthorised programs and bulk exports: watch application servers for new executables or web shells. Alert on unusually large database reads or exports from service accounts.
- Add these questions to vendor due diligence: how the vendor manages support-staff accounts, how it detects malicious programs being planted, and how quickly it patches internally developed application code.
- Prepare your customers for phishing: if your brand sends mail through an affected system, tell recipients clearly how you will and won't contact them. Monitor for lookalike domains and campaigns impersonating you.
Sources: Ymirlink Cuenote Breach: 9 Million Records Taken TSN | Days when the method of intrusion was written, and days when it was... | メール配信のユミルリンクに不正アクセス メールアドレスなど延べ約900万件｜西のITメディア | 企業・官公庁のメール配信を担うユミルリンクに不正アクセス | YMIRLINK,Inc. Discloses Potential Personal Data Leak｜Impact on FY20... | 【ユミルリンク】メール配信サービスのサーバーに不正アクセス、メールアドレスを含む情報 延べ約900万件が外部に出力 国内セキュリティ... | 当社システムへの不正なアクセスに関するご報告（第一報）｜メールマーケティングのCuenote | メール配信サービス「Cuenote FC」に不正アクセス、ユミルリンクが延べ約 900 万件の情報の持ち出しを公表 – ナウレッジ株式会社