2026.10.18. The Fair Economy — Yamato Transport said that unauthorized access to its online payment service, the "Kuroneko Postpaid Service," leaked customer information for approximately 5.31 million users.
Several local media outlets, including Asahi and Yomiuri, reported on the 16th that Yamato Transport had announced the results of its investigation.
The leaked data includes the names, addresses, phone numbers, email addresses, and product details of approximately 5.26 million customers who used the service from October 1, 2018, to September 28 this year. Of these, about 490,000 records included email addresses. Delivery information for approximately 50,000 cases after February 5, 2021, and merchant information for about 4,100 cases were also leaked. Credit card details and passwords were not included.
Yamato Transport detected the unauthorized access on September 28 and suspended the service that same night, announcing the possibility of a data leak on the 29th. The company then conducted an investigation with an outside security firm, resumed the service on October 9, and released its final findings on the 16th.
Regarding the leak, the company said, "We once again deeply apologize for the great inconvenience and concern caused to our customers and other parties involved." While no secondary damage from misuse of the leaked information has been confirmed so far, the company urged caution regarding suspicious emails, text messages or phone calls impersonating Yamato Transport.
Jiji Press reported that Yamato Transport explained that the leaked data spanned about eight years because the company "retained it for a certain period to handle inquiries and other matters."
Yamato Transport plans to individually contact the affected customers and merchants in stages. The company also intends to strengthen its information security system and focus on preventing recurrence through medium- to long-term measures based on advice from outside experts.
Yamato Transport's "Kuroneko Cash on Delivery Service" is a payment service launched in October 2018, allowing internet mail-order customers to pay at convenience stores after receiving their goods. Of the information leaked this time, about 5.26 million records belong to customers of this service, putting the company's long-term data retention practices under scrutiny.
The Kuroneko Postpaid Service has maintained a high usage rate in Japan's e-commerce market. As of 2025, the number of registered users is estimated to reach approximately 12 million, and the "postpaid" option is widely adopted by online shopping malls. The data breach has heightened user anxiety, leading more consumers to consider switching to competing payment services.
Yamato Transport has experienced personal data breaches several times before this incident. In 2014, customer information was leaked from the internet shopping mall "Yamato Transport Net Shop," and in 2019, about 70,000 records of personal information were leaked from the "Kuroneko Members" site. In 2022, a system managed by its subsidiary Yamato System Development was hit by a cyberattack, leaking names and contact information of business partner employees. This history has led to criticism that this large-scale leak is not a one-off but may be a repetition of structural security vulnerabilities.
Japan has recently seen a series of cyberattacks targeting logistics and payment services. In 2025, an incident occurred in which customer information was leaked from a parcel delivery service operated by Japan Post Service, and in 2024, Sagawa Express suffered a cyberattack that leaked about 500,000 pieces of personal information. In March 2025, a Japanese online shopping site was hacked, leaking about 1 million pieces of personal information, and in July 2025, an attack targeting a parcel tracking system occurred. Observers point to the accelerating digital transformation of the logistics industry and insufficient investment in cybersecurity as underlying causes.
0 Comments
No comments yet.