Yamato Transport confirms 5.31 million records leaked as Nikkei and Fancl also disclose breaches

TLDR

• Yamato Transport said on 16 October that about 5.31 million records leaked from its Kuroneko deferred-payment service.¹²
• Nikkei said about 1.83 million records leaked from a cloud service, accessed with stolen credentials, per Kyodo.²³
• Kirin said its Fancl and ATENEA e-commerce sites leaked 393,785 and 441,162 member records respectively.⁴

Yamato Transport's fourth notice on the incident says the third party accessed the Kuroneko deferred-payment service, which lets online shoppers pay after receiving goods, and that an investigation with an external security firm found some information was taken.¹ The notice gives roughly 5.26 million customer records covering 1 October 2018 to 28 September 2026 (names, addresses, phone numbers, email addresses, item details and internal management data), of which about 490,000 include email addresses, plus about 50,000 recipient records covering 5 February 2021 onwards and about 4,100 merchant records; it says credit card and password data were not included.¹ Yamato says it has reported the incident to Japan's Personal Information Protection Commission and has confirmed no secondary harm, although it has received queries about suspicious emails, SMS messages and calls.¹ Kyodo says the service was suspended after the 28 September detection and resumed on 9 October.²

Jiji Press, which also reports the Yamato figure and the roughly eight-year span of the data, says Nikkei's breach involved a cloud service used for system development.³ Kyodo says Nikkei reported that the credentials used to access the cloud service were stolen, that unauthorised access began in the early hours of 7 October, that 1.68 million of the records cannot identify an individual on their own, and that no secondary damage or system suspension has been confirmed.²

Kirin's notice says the Fancl and ATENEA records include email addresses, full names, addresses, phone numbers, dates of birth, gender and support IDs, with passwords hashed, that it has reported the incident to the Personal Information Protection Commission and begun consultations with the police, and that it has set up an emergency response headquarters.⁴ The notice counts 368,184 people for Fancl and 417,312 for ATENEA, against the 393,785 and 441,162 records, and says payment information was not affected.⁴ Kyodo gives the unauthorised access window as 3 to 10 October and spells the second company Attenir.²

Why it matters: the three disclosures on a single day show customer-facing and cloud systems at large Japanese firms being used to take contact and personal details at scale, and Nikkei's case, per Kyodo, involved stolen authentication credentials.²