On 30 October 2026, four pharmaceutical associations announced that 30,750 email addresses registered for PRAISE-NET mail delivery may have leaked through unauthorised access at Ymirlink, the email delivery contractor. The announcement described a contractor incident. It did not describe unauthorised access to PRAISE-NET itself. PRAISE-NET serves member associations and companies with a pharmaceutical administrative notification database, member information, committee information, seminar registrations, questionnaires, and other services. The count covers addresses in the mail delivery service only.
Announcement and scope
Confirmation of the figure came on 29 October 2026, one day before publication. The four bodies behind the notice were the Federation of Pharmaceutical Manufacturers' Associations of Japan, the Japan Pharmaceutical Manufacturers Association, the Tokyo Pharmaceutical Manufacturers Association, and the Kansai Pharmaceutical Industries Association. Their notice framed the event as an incident at the contractor. The primary notice is published by the Japan Pharmaceutical Manufacturers Association, and a summary of the same notice is available from SmartScope.
The affected group was defined by registration for mail delivery. Only PRAISE-NET users with addresses registered for that service fell inside the stated scope. That group is smaller than the full PRAISE-NET user base. The notice gave the figure as addresses, with no presentation of the figure as a confirmed number of distinct people, because the notice counts addresses in the mail delivery service.
Exposed data and excluded data
Email addresses were the only data said to be potentially leaked from the PRAISE-NET mail delivery service. The notice stated that position directly. According to the associations, nothing besides email addresses had been registered in that service. PRAISE-NET ID information fell outside the leaked set. The excluded items were company name, name, department, address, telephone number, and password.
The list is unusually complete for a client disclosure. It confines direct exposure to the address itself. Phishing risk remains, because a leaked address can still receive targeted mail. No password change was stated as necessary in the notice. The general question of whether a password change helps after a leak is covered separately in does changing your password stop hackers.
Vendor incident and chronology
16 October 2026 was the date Ymirlink confirmed unauthorised access to some systems. On 19 October 2026, Ymirlink reported unauthorised access to some servers of Cuenote FC, its email delivery service. At that stage, Ymirlink told the associations that the PRAISE-NET mail delivery environment lay outside the scope of the incident. Further investigation changed that assessment. On 26 October 2026, Ymirlink reported that PRAISE-NET user email addresses may also have leaked from the PRAISE-NET environment.
29 October 2026 was the date the associations confirmed the number as 30,750 email addresses. Publication followed on 30 October 2026. The vendor incident behind the disclosure was already covered in the published Ymirlink data breach article of 28 October 2026. In a second report on 26 October 2026, Ymirlink stated that data output such as email addresses was confirmed from 49 Cuenote FC systems, with a cumulative total of 51,628,280 records. Counting continued for 16 systems, so that cumulative total could increase.
The cause in Cuenote FC was a library vulnerability, according to that second report, which is published by Ymirlink. The 30,750 figure must not be added to the 51,628,280 cumulative record total. Two reasons support that separation. The vendor total counts cumulative records, not distinct people. PRAISE-NET systems may also sit inside the 49 systems already counted. The same separation applies to the JR member figures covered in the earlier Ymirlink article, which are described in the Railway Supply summary of the JR joint notice.
Association response
Bulk email delivery via Ymirlink was suspended promptly by the associations after the 26 October 2026 report. Other PRAISE-NET mail did not travel through Ymirlink. That mail was not suspended. Reports went to the Personal Information Protection Commission and the Ministry of Health, Labour and Welfare. An extraordinary notice went to users who may be affected, and it was delivered to the registered email addresses held for those users.
Recurrence prevention measures, including contractor management, will be considered, the associations stated. Resumption of bulk email delivery via Ymirlink will be announced once safety is confirmed. No resumption date was given in the notice. Ymirlink reported separately to the Metropolitan Police Department, the Personal Information Protection Commission, and JIPDEC. Police and commission reports were dated 19 October 2026 in its second report, and JIPDEC reports were dated 20 October 2026. Those three destinations belong to Ymirlink, not to the associations, and the two sets of reports are kept separate here.
As of its second report, Ymirlink also stated that no public disclosure of leaked personal data and no misuse arising from the incident had been confirmed. Ymirlink warned at the same time about impersonation mail sent from its own domain.
Measures for affected people
Users who may be affected received an extraordinary notice email, the associations stated. The check described in the notice is whether that notice arrived in the inbox or spam folder of the registered address. No public lookup for an individual PRAISE-NET address is described in the sources. None is presented here. Users unsure whether they are affected can contact the PRAISE-NET operating body, the Kansai Pharmaceutical Industries Association inquiry desk listed in the notice.
Suspicious mail and phishing mail may arrive at registered addresses, the associations warned. PRAISE-NET and the four operating associations never ask for passwords or other information by email, they stated. Mail impersonating notifications from the Ministry of Health, Labour and Welfare was also flagged in the associations warning about suspicious mail. Notification contents should be checked through official publication channels such as the Ministry website, according to the notice. For unrecognised mail, the notice asks recipients not to open URLs or attachments, not to call phone numbers listed in the mail, and to delete the mail.
The associations notice required no password change. The exclusion of password data from the leaked set is the basis for that position. The impersonation pattern in this case matches the pattern described in how phishing uses your leaked email.
A registered PRAISE-NET address may be in this set. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Open questions and next reports
Further facts found in future investigation will be announced promptly, the associations stated. The notice gives no new count, no confirmed misuse figure, and no resumption date for bulk delivery. The vendor investigation remains open for the 16 Cuenote FC systems still being counted in the second report. That vendor cumulative total may change without changing the PRAISE-NET figure, because the two totals count different things and are never combined in this article. The PRAISE-NET figure itself is stated only as addresses that may have leaked as of 29 October 2026.
Any update to this article should come from a new associations notice, a Ymirlink update that changes the counted systems or the cumulative total, or a confirmed resumption of bulk delivery. Any such update must keep the PRAISE-NET count, the JR member figures, and the vendor cumulative total as separate figures that are never added together.
Top comments (0)