This week in email privacy covers six stories published from 27 October to 1 November 2026. Ymirlink reported 51,628,280 records that may have leaked, Muji reported up to 27.26 million application records that may have leaked, and Proton cancelled planned AI staff re-interviews before the scheduled round began.
Ymirlink email service records
Ymirlink reported on 26 October 2026 that data may have leaked from 49 Cuenote FC systems, totalling 51,628,280 records, with 16 systems still being counted, as reported in the Ymirlink article. The set includes email addresses, and the company warned of spam sent from its own domain under third parties' names, which raises the risk of messages that look like they come from a known sender. A separate address for each service limits that exposure, because a leaked address points to one service rather than to a person's main inbox.
Muji application records
Ryohin Keikaku said up to 27.26 million MUJI App records may have leaked, with email addresses, dates of birth and gender in the set, as reported in the Muji article. Names, addresses, phone numbers and credit card details were excluded from the reported set, which limits direct financial exposure from this announcement alone. The email addresses still matter for the inbox, because they can be used for phishing and for matching a person to other leaked sets.
Fore Coffee application accounts
Fore Coffee disclosed to the Indonesia Stock Exchange on 28 October 2026 that unauthorised access affected up to about 5.7 million FORE app accounts, as reported in the Fore Coffee article. The data that may have been exposed varies by customer and includes names, email addresses, phone numbers, delivery addresses, hashed PINs and purchase history, while payment card data was not affected. An address used only for one application keeps a leak of this kind contained to that application, rather than spreading to every account that shares the same address.
Sony membership records
Sony Network Communications disclosed on 27 October 2026 that unauthorised access on 19 October 2026 to its So-net membership database exposed 2,585,481 So-net and plala membership records, as reported in the Sony article. The records contained names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs, and a subset of 54,401 records also contained email service passwords, which the company initialised on 27 October 2026. Membership passwords were not leaked, according to the company notice, so the password risk in this incident is specific to the email services in the subset, not to the membership accounts as a whole.
Amadeus airline booking records
Five airline groups disclosed in late October 2026 unauthorised access to reservation data held by travel technology provider Amadeus, as reported in the Amadeus article. Cathay Pacific reported about 53,000 bookings affected, Japan Airlines and Japan Transocean Air reported about 92,000 customers affected, and All Nippon Airways reported about 37,800 customers affected, while Korean Air and Asiana Airlines gave no overall customer count, so no consistent industry total exists. The airlines warned about messages impersonating the airline that quote a real booking reference, name or flight, which makes a booking address used only for travel easier to recognise as compromised and easier to close.
Proton staff re-interviews
Proton chief executive Andy Yen cancelled planned AI staff re-interviews on 30 October 2026, before the scheduled 4 to 11 November 2026 round began, as reported in the Proton cancellation article. The planned round had been described in a leaked email reported by 404 Media, as reported in the Proton interviews article. Nothing in the reporting establishes a change to Proton encryption or privacy practices, and the reporting presents the matter as a labour and culture story at a company rather than a security incident.
Coverage and guides
AliasFleet published a full article on each story above, linked in each section. The full articles carry the company notices, the data fields in each set, and the published guidance for each incident. The breach-response guide states that an address can be checked on Have I Been Pwned, and the leak-check guide describes the same check. An email alias is a managed, persistent identity, with a separate alias for each online account, so a leak at one service does not expose the address used elsewhere.
Top comments (0)