Yumelink: Cuenote FC Email Platform Breach Exposes 47.86 Million Records

Yumelink, a Tokyo email delivery company, has confirmed that attackers exported 47,864,147 records from 49 customer systems of Cuenote FC, its bulk email service. The company also appears in reports as Ymirlink and Yumil Link. It gave the figure in its third report on November 11. That report lowered the count from the "up to about 51.62 million" (51,628,280) it gave on October 26. The company says the drop came from removing duplicate records and records that were never actually exported. Its first report, on October 19, estimated about 9 million records from five systems. The total counts records, not people: one person can appear in several client address books. Clients that have disclosed their own losses include JR Central, which reported jointly with JR West and JR Kyushu, and istyle, which runs the @cosme cosmetics review site. Japan Cyber Watch ranks the breach as Japan's third-largest of 2026. No threat actor has been named, and nobody has claimed the attack.

What Happened

Yumelink's three reports give this timeline. A staff member noticed something wrong with their own account at 06:49 on October 16. By 10:10 the company had traced the problem to an attack through a software vulnerability and blocked the attacking IP address. Japan Cyber Watch reports that a fix was applied to all platforms at 20:46 that evening. On October 17 and 18, Yumelink found malicious programs on more systems and began deleting support accounts. As a precaution, it shut down every system in the affected data centre.

The first report on October 19 named five systems. On October 22 the company began reviewing login and activity logs for every system. On the night of October 25 it found unauthorized access and data exports on dozens more. Japan Cyber Watch, JapanHacked and bankenjp all say 42 more systems were found. The phrasing of Yumelink's own third report suggests 45 were added. Both versions arrive at a final total of 49. According to JapanHacked, the attackers tried to access 81 Cuenote FC systems. Three systems shared by several clients leaked nothing. The 49 that leaked data were all single-client systems.

The delay created confusion for clients. Camera retailer Syuppin says Yumelink told it on October 20 that no personal data had left the platform except from a few environments identified early on. On October 26 Yumelink told Syuppin its address book data had probably been taken. Bankenjp reports that Yumelink told publisher Sendenkaigi on October 21 that it was "out of scope", then corrected that five days later. JapanHacked says many clients went through the same reversal.

Separately, Yumelink says a vulnerability in Cuenote BASE, its own customer management system, left 190 records about client contacts viewable from outside. Those records contain company names, contact names, phone numbers and email addresses. Yumelink says its other services were not accessed: SR-S, SMS, Auth, Survey, Push and the safety confirmation service.

The company has reported the incident to the Tokyo Metropolitan Police Department, the Personal Information Protection Commission and JIPDEC. It plans to report to Japan's IT promotion agency, IPA, once the root cause is confirmed.

What Was Taken

Yumelink's third report breaks down the exported Cuenote FC data as follows (each figure counts records, so one person may appear more than once):

• 47,864,147 email addresses
• 30,500,167 member IDs
• 6,665,055 names
• 2,059,658 gender entries
• 1,823,551 postal codes
• 1,212,868 prefectures
• 949,217 dates of birth
• 412,794 phone numbers
• 226,158 hashed passwords
• 152,868 addresses
• 98,381 company names
• 10,608 school names
• 420,419 sets of login credentials for a client's service that closed in February 2026

The company says it has found no evidence that credit card or other payment data was taken. It is still checking exactly which data fields were included. Because each client stored different fields in Cuenote FC, what was exposed varies by client. For example, Syuppin says its address book held email addresses, point balances, point expiry dates and prefectures.

Client disclosures so far include:

JapanHacked counts 34 affected organisations. As of Yumelink's second report, no leaked data had been seen published or misused. However, JapanHacked reports that several spam emails claiming to be from Saison Card had been sent using Yumelink's domain.

Why It Matters

This is a supply-chain breach. One vendor's privileged access exposed dozens of brands at the same time. Japan Cyber Watch counts four Japanese bulk email providers breached in October 2026: Arcadia, Yumelink, Blastmail and Y-mail. In each case, the attackers reached the access the vendor itself uses to set up and support its customers' environments. The publication says three of the four were then used to send phishing.

That matters because phishing sent from a hijacked legitimate sending platform passes SPF, DKIM and DMARC checks. In a case like this, email authentication does not help the recipient. The leaked address books are also ideal phishing material, because they tie real email addresses to the brands those people actually use. Phishing that claims to come from JR, @cosme, Life Card or a retailer's loyalty programme will be hard to spot.

Finally, the leaked hashed passwords and the 420,419 sets of credentials for a client's closed service could be reused in credential-stuffing attacks against other sites.

The Attack Technique

Yumelink has not named the vulnerable component. It also has not said whether the flaw was already publicly known when it was exploited. Its second report describes the flaw as a vulnerability in a software library. Based on Yumelink's reports, the attack had two phases.

Direct compromise (first five systems). The attackers used the vulnerability to steal credentials belonging to a support and quality-assurance account. They planted a malicious program and read databases directly. Japan Cyber Watch reports that this maintenance account existed on every platform. The attackers used it to try logging in to other systems and to read their data through the planted program.

Session hijacking (the remaining systems). On the other systems the method was quieter. The attackers stole session data from people who were logged in at the time and entered the admin console as them. They then downloaded data with the console's normal CSV export. Because this looked like routine admin work, it was only found by reviewing every system's logs, nine days after the first detection. Bankenjp notes that Yumelink admitted some admin screens and APIs had no IP address restrictions until October 18.

What Organizations Should Do

1. Check what data you store with email vendors. Ask your email delivery provider which fields it holds and when it last checked them. Remove anything not needed to send mail, such as point balances, birth dates, credentials and full message bodies.
2. Require IP restrictions and MFA on vendor admin consoles and APIs. Ask for short session lifetimes, sessions tied to a device or IP, and alerts on bulk CSV exports.
3. Ask vendors about shared support access. Find out whether the vendor's support staff use standing or shared accounts that work across tenants. Require temporary, logged access that a named person approves.
4. Do not rely on your vendor's first "you're not affected" message. Yumelink's message changed after a full log review. Keep your own export logs and send your own notices.
5. Prepare for phishing that uses your brand. Warn customers ahead of time, publish the domains you actually send from, and watch for mail sent under your name that you did not send.
6. Reset credentials that may have been exposed. If hashed passwords or service credentials were in your address books, force password resets and check for credential-stuffing attempts.

Sources: Yumelink breach: 47.86 million records leaked · Osegi | ユミルリンク：メール配信サービス「Cuenote FC」に不正アクセス JapanHacked | Four Email Delivery Services Breached in a Month: Why Japan's Bulk... | 当社システムへの不正なアクセスに関するご報告（第三報）｜NEWS｜メッセージングソリューションのユミルリンク | 【お知らせ】一部外部メール配信サービスへの不正アクセスに伴う、 当社個人情報流出の可能性について シュッピン株式会社 | How Yumil Link's Cuenote Was Breached: Stolen Sessions, a Normal CS... | ユミルリンク：メール配信サービスへの不正アクセスで顧客の個人情報が流出した可能性 日本脆弱性総合ポータル | Days when the method of intrusion was written, and days when it was...