Yamato Transport confirmed on 16 Oct that attackers took about 5.31 million records from its Kuroneko pay-later service. A delivery company holding eight years of what you bought is a profiling file, not a shipping log. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source.
The scam this file makes possible
Start with the message, because that is where this breach lands.
It names the shop you bought from. It names the item. It names the address the parcel went to. It says something went wrong with the payment, and it hands you a link to fix it. Every detail in it checks out, because every detail came from the real file. Only the sender is fake.
That is the specific danger here. The file does not just hand attackers contact details. It hands them true order details, the kind that make a forgery read like a receipt. And for most victims, the message will not arrive by email at all. Only about 490,000 of the purchaser records carry an email address. The rest of the file points attackers toward phones, text messages, and post.
Yamato has already heard from people getting suspicious mail, text messages, and calls. The company says none of that has turned into confirmed harm yet. Treat that as a timing statement, not a clean bill of health.
A message that quotes your real shop, your real item, and your real delivery address is not verified by those facts. Those facts are the leak. Verify through Yamato's own site, typed by you, or a contact channel you already trust. Never through a link or number inside the message itself.
What Yamato confirmed, and what it cleared
Yamato published its fourth report on 16 October. This one swapped 17 days of uncertainty for confirmed counts. ITmedia and Business+IT covered the disclosure, and the primary source is Yamato Holdings' own notice.
| Confirmed taken | Not in the leak |
|---|---|
| About 5.26 million purchaser records, 2018-10-01 to 2026-09-28 | Credit card information |
| About 50,000 delivery-destination records, 2021-02-05 to 2026-09-28 | Passwords |
| About 4,100 merchant records, 2018-10-01 to 2026-09-28 | Billing amounts, credit balances, employee names (flagged 2 Oct, cleared 16 Oct) |
| No confirmed secondary misuse as of 16 October | Any confirmed public surfacing of the dataset |
The purchaser records are the bulk of it. They hold names, addresses, phone numbers, email addresses, purchase details (product name, quantity, unit price), and internal admin details (application number, order date, credit reference number). Roughly 490,000 of them include an email address, about 9 percent. Read that split carefully. Most victims are exposed through name, address, phone, and purchase history, not through email.
Then there is the smaller, stranger bucket. About 50,000 delivery-destination records list recipients: names, addresses, phone numbers, tracking numbers. That bucket may include people who never used the service. Somebody bought them a gift, sent it to their address, and paid later. Their name and address are in the file now anyway.
The merchant records cover about 4,100 shops: merchant names and merchant codes. Shops that offered the pay-later checkout sit in the file next to their customers.
One counting note. Yamato reports records, not people. The 5.31 million is a sum of approximate counts across three categories, and one person can show up more than once. Do not read it as 5.31 million victims. It is 5.31 million records. That is bad enough without inflating it.
How it unfolded
Yamato confirmed the unauthorised access on 28 September and stopped the service that night at 22:28. The first report followed the next day, 29 September. A second report on 2 October warned that customer, merchant, and employee information may have leaked, and named billing amounts, credit balances, and employee names among the possibly exposed fields.
The service came back on 9 October, after safety checks. Payment deadlines for slips due on or after 28 September were extended by 17 days. A timeline of the first three reports fills in the restart details.
The fourth report on 16 October locked in the counts and cleared the three 2 October items. That correction deserves a plain word of credit. Yamato flagged fields it was unsure about, investigated, and then said they were not taken. Companies often let an early warning stand uncorrected. This one did not.
Parcel delivery never stopped. TA-Q-BIN kept running throughout. Only the pay-later checkout went down, which is worth saying outright, because a breach at a delivery company sounds like a delivery problem. It was a payment-service problem.
Yamato also says it reported the incident to Japan's Personal Information Protection Commission, and that it is contacting affected people one by one. Where contact is impossible because registration details changed, the public notice stands in as the notification. That last part is easy to miss, and it matters. Some affected people will never get a letter or an email. The notice is their notification.
Eight years of receipts is a profile
Eight years of pay-later records is not a single order. It is a pattern. What you bought, how often, what you paid per item, where it went, and which address you used when the delivery address was not your own.
A name plus an address plus a phone number is an identity record. Layer product names, quantities, and unit prices across eight years on top of it, and it turns into something else: a record of habits, gifts, household changes, and spending. Add delivery destinations and it maps relationships, because gifts travel to other people's addresses. Add merchant codes and it maps which shops you buy from.
That is why the cleared items soften this so little. Billing amounts, credit balances, and employee names turning out not to be taken is good news. It does not change the shape of what was taken. An attacker who knows what you bought, where it went, and which shop sold it does not need your balance. The purchase detail is the part that makes a scam message believable.
The checkout detail you actually control
Here is the part you control. You cannot change your name, your address, or your phone number every time a service leaks. You cannot un-buy eight years of orders. But the email address you hand a checkout is a choice, and it is the one field in a leaked record you can make expendable.
The mechanism is a unique email alias for each service you sign up for, forwarding to your real inbox. One address for the pay-later checkout, a different one for the next shop, and so on. When a breach file circulates, the alias in it points at exactly one source. That is the leak-tracing mechanism: a message lands on the pay-later alias and you know at once which service it escaped from. Kill the alias and that channel dies while your real inbox stays clean.
This does not undo the Yamato leak. Aliases do not protect the name, address, phone, or purchase history already in the file, and anyone who tells you otherwise is selling something. What an alias does is narrower and real. It stops the next leak from handing attackers a working email address that reaches you, and it turns every future breach notification into a message you can authenticate by the address it arrived on. A "payment problem" message that lands on an address no one but that service ever had is either from that service or from the attacker. A payment message that lands on any other address is the forgery announcing itself.
The limit here is the same one that runs through this whole story. The alias guards the email channel, not the identity record. Most of Yamato's records do not include an email address at all, and those victims still need to watch their phones, their texts, and their post. An alias is one control, not a cure.
If you used the pay-later checkout
- Start from the assumption that any message quoting a genuine order came from this leak. Shop name, item, delivery address: when all three are right, that accuracy is the trap, not evidence the sender is real.
- Never follow a link inside a breach message, even one that looks like Yamato's real notice. Type Yamato's address yourself or reach them on a channel you already use. A rule that only holds for obvious fakes is no rule at all.
- Give calls and letters the same distrust you give email. Phone numbers and postal addresses are in the file, so a caller reciting your own order back to you only proves they have the leak. A mailed slip quoting a real purchase gets checked with Yamato directly, not through any number printed on the slip.
- Warn anyone you bought gifts for. Recipient records put gift receivers in the file as well, so tell them what was exposed before a message naming their address reaches them first.
- Shop owners: treat any approach claiming to be Yamato's account team as suspect until you confirm it on a channel you already use. The file holds merchant names and codes, which is precisely the material an impersonator needs to sound official.
- Once the incident appears on Have I Been Pwned, look yourself up there, then follow the breach-response order of operations: contain, verify, then harden.
Three questions still without an answer
Three gaps remain. First, the attack vector. No source has said how attackers got in. Second, when the intrusion began. Only the 28 September confirmation date is known, so the dwell time is unstated. Third, whether the dataset has surfaced publicly or been traded. Nothing in any source read for this piece reports that, and no confirmed misuse has been reported either, which is the one genuinely reassuring fact in the file.
There is also wider context worth one paragraph and no more. Yamato was one of several Japanese companies disclosing breaches in the same weeks, and Sagawa Express disclosed its own unauthorised access days later, hitting a different service. No company has stated a connection between the incidents. The wave is real, but this article is about Yamato's file, and the file is specific enough on its own: eight years, three record types, one profiling file, and an email count that tells you exactly where the controllable damage sits.
Top comments (0)