Your vendor's breach is your breach. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. On October 21, Raxus Light Cloud's own notice confirmed intruders had entered two API servers of its Blastmail email-delivery service, and that some customers' delivery lists were confirmed taken. A newspaper has since confirmed about 253,000 of its members leaked. A points mall and a wrestling promotion say their lists may have leaked; a SaaS company is still confirming its scope. None of the four was breached itself. Their vendor was.
What Raxus said happened
Blastmail is a bulk email-delivery system run by 株式会社ラクスライトクラウド, a wholly owned subsidiary of the Japanese software firm Raxus. The notice, updated October 22 at 17:00, describes the attack plainly: an external third party got into two of Blastmail's API servers, ran commands on them, then connected from those servers into the company's sales-management system and its service databases and took data out. How the attacker reached the API servers in the first place is still under investigation, and Raxus makes no claims about it.
The service went dark fast. Blastmail stopped at 00:30 on October 21, the management console and API with it, and mail delivery ground to a halt around 01:00. There is still no resume date.
Two kinds of data left the building, and Raxus is careful to keep them separate. First, every contractor's sales-management record: company name, contact-person name, phone number, email address, billing email address, and contract and payment history. Raxus confirms all of it was exfiltrated. Second, the delivery lists of some customers: confirmed leaked for some, with the company individually notifying those customers from around 14:00 on October 22. Raxus holds no credit card numbers, which is the one piece of good news in the file. The honest split:
| Confirmed | Still unconfirmed |
|---|---|
| The intrusion and exfiltration, in Raxus Light Cloud's own notice, updated October 22 at 17:00 | The route into the two API servers; still under investigation |
| All contractor sales-management records exfiltrated: company names, contact names, phone numbers, email and billing-email addresses, contract and payment history | Which delivery lists beyond the confirmed ones are in the leak, and the total record count |
| Some customers' delivery lists confirmed leaked; individual customer notifications began around 14:00 on October 22, running behind schedule | Whether the stolen data has surfaced publicly or been misused |
| No credit card numbers involved: Raxus holds none | When the service resumes; stopped since October 21 at 00:30, date undetermined |
| A progress report promised for October 23 at 10:00 JST | How long full-scope confirmation will take |
One detail for flavour. Raxus Light Cloud prints a Privacy Mark (認定番号 第10821806号) at the foot of its breach notice. Certification is not prevention. It never was.
Four brands, one database
The downstream notices landed within hours of each other on October 22. Every one of them describes damage the company did not cause.
| Company | What leaked | Status |
|---|---|---|
| Niigata Nippo | All "Niigata Nippo Passport" members: name (katakana), prefecture, municipality, email address, gender, age group, subscribed product, subscribed newsletter service. Estimated maximum about 253,000. No card numbers, phone numbers, birthdays, bank accounts or passwords. | Confirmed leaked (second report, October 22) |
| Tohoku Electric Power Frontier | "e-Point Mall" members: email address and internal member ID, up to about 100,000. No names, addresses, phone numbers, card or bank data, no passwords. | May have leaked; the company is still confirming |
| New Japan Pro-Wrestling | Registered email addresses for the official "New Japan Pro-Wrestling email magazine". The separate Team NJPW fan-club magazine runs on a different system and is unaffected. | May have leaked (October 22) |
| Nulab | Customer email addresses, plus for some customers space IDs, space keys, organisation names and customer numbers (on-premise only). No passwords, no card data. Nulab's own services show no unauthorised access. | Confirming scope; second report pending |
Tohoku Electric Power Frontier's case carries one extra twist. The developer and operator of e-Point Mall is Raxus Light Cloud itself, not just a mail vendor in the background. The company learned about the intrusion on October 21 from its outsourcing partner ADDIX, then shut the points-mall site temporarily along with its mail magazine. And Niigata Nippo suspended its newsletter services outright.
Picture the people behind the rows. A newspaper reader who signed up for reporter picks. A points-mall shopper chasing loyalty rewards. A wrestling fan who wanted match news. A Backlog user who never opened a marketing email in their life. Four different inboxes, four different companies, and all of them flowed through the same vendor's database, which none of the four had any part in losing. This is the standard shape of modern supply-chain breaches: the data boundary sits wider than the brand boundary. The rocket-boys.co.jp roundup counted at least 36 organisations publishing notices by October 22, including newspapers, municipalities and event operators, some of which lost disaster-prevention notification channels.
If you received one of those apology emails this week, here is the one line that matters: you did nothing wrong, and the company that emailed you did nothing wrong either.
The breach email is now the attack
Leaked delivery lists are a peculiarly dangerous kind of theft. The attacker does not just get email addresses. They get the victim list, the real names, and the real context, the exact ingredients of a convincing impersonation. JAPANSecuritySummit's attack-path piece flags the secondary risk directly: forged emails impersonating the legitimate senders. NJPW, Tohoku Electric Power Frontier and Nulab are all warning their customers about it in their notices.
So expect "important notice from New Japan Pro-Wrestling" emails that quote the real apology and link somewhere else. The forgeries will read better than most phishing, because they are written with the truth as a first draft.
A genuine notification is plausible and a forged one is certain. Both exist now. The message that quotes the real apology and links to a "confirmation page" asking for anything is not from the company. Open the official site or app yourself. No link in any email about this breach is worth clicking, including the real one.
What victims should do now
- Assume your email address is out there with the right name attached. The Niigata Nippo leak pairs addresses with katakana names, prefectures and municipalities. That is enough to write a message that reads like it knows you.
- Do not click links in any email about this breach. If Nulab, NJPW, Tohoku Electric Power Frontier or Niigata Nippo contacts you, verify through the company's own site, typed by you.
- Expect impersonation calls and SMS, not just email. Anyone who "confirms your identity" by reading your own details back to you is proving they hold the file, not that they work for the company.
- Turn on two-factor authentication on your email account. Leaked names and addresses are the raw material of account-recovery flows; 2FA is the part an attacker cannot talk their way past.
- Check Have I Been Pwned once the incident is listed, and turn on its breach notifications.
- Walk the breach-response order of operations: it is written for exactly this situation, where the company that warned you is not the company that leaked you.
One address per signup
The email address each victim handed over was a choice, and it is the one field in every leaked record that can be made expendable.
The mechanism is simple: a unique email alias for the newsletter or signup, forwarding to your real inbox. When the Blastmail data circulates, the only address the attacker holds for you is the one you gave the wrestling magazine or the points mall. The leak-tracing mechanism works exactly this way: a phishing mail lands on the e-Point Mall alias and you know at a glance which vendor it escaped through, no guesswork about whose breach it was. Kill that alias and the whole impersonation channel dies while your real inbox stays clean. The set-up guide takes about two minutes.
The part aliases cannot fix: the name, prefecture and municipality a newspaper already holds are out of your hands, and no alias stops a scam call that reads your own details back to you. What the alias does is narrower and more useful. Every future "important notice" arrives on one killable address, and that address names the leaker. Newsletter signups are the address everyone was always going to lose. You hand the real email to a mailing list for the updates and forget the account exists. Four companies, none of which did anything wrong, and the loss came through a mail-delivery vendor two levels down. Next time the notice arrives, one address per signup means you can see in the address itself who let it out.
What the October 23 update must answer
Three things. First, the 10:00 JST progress report Raxus promised: whether the confirmed delivery-list count grows past Niigata Nippo's 253,000, and whether the individual customer notifications caught up with the schedule they were already missing. Second, Nulab's second report: is its customer data confirmed in the leak, and how many customers are in scope. Third, the impersonation wave. Four brands' worth of sender-accurate victim lists, with names and real contexts, is the raw material for how phishing uses a leaked email at scale. If the forgeries land, they will not look like phishing. They will look like the apology.
The vendors trusted a vendor. The vendor lost the lists. The lists are now the ammunition. Ten o'clock JST is when Raxus tells the rest of the story.
Top comments (0)