The YmirLink data breach is an unauthorised access incident at a Japanese email delivery service provider in which data may have leaked from 49 Cuenote FC systems, totalling 51,628,280 cumulative records on 26 October 2026. YmirLink detected the unauthorised access on 16 October 2026 and issued a first report on 19 October 2026 covering five systems and about 9 million cumulative records containing email addresses. The second report raised the system count to 49 and the record count to 51,628,280, with counting still under way for 16 systems, so the cumulative total may rise. The same date brought a joint notice from JR Central, JR West and JR Kyushu stating that Smart EX and Express Reservation members who received mail through Cuenote FC had email addresses, member IDs, katakana names and membership types leaked.
Incident dates
On 16 October 2026, YmirLink detected unauthorised access to its systems, and on 19 October 2026 it issued its first disclosure, covering five Cuenote FC systems and an estimated 9 million cumulative records containing email addresses. The Mainichi reported the same 9 million figure on 19 October 2026. On 26 October 2026 at 5 p.m., YmirLink updated its incident report with the second set of figures, and the three JR companies issued their joint notice on the same day. Kyodo News reported the 51 million figure at 20:36 JST on 26 October.
| Date | Event |
|---|---|
| 16 October 2026 | YmirLink detected unauthorised access. |
| 19 October 2026 | First disclosure: 5 systems, about 9 million records containing email addresses. |
| 26 October 2026, 5 p.m. | Second report: 49 systems, 51,628,280 records, 16 systems still being counted. |
| 26 October 2026 | JR joint notice, and a report to the Personal Information Protection Commission. |
| 27 October 2026 | Broadcast reporting and further client disclosures. |
Records exposed
YmirLink said 81 Cuenote FC systems were targeted by unauthorised access, comprising 3 systems shared by several client companies and 78 systems used by a single client company. Leakage was reported from 49 systems, all of them single-client systems, and none of the 3 shared systems. A summary citing the YmirLink incident report page sets out the first and second report figures side by side. The record total in the second report was 51,628,280 on a cumulative basis, and counting continued for 16 of the 49 systems, so that total may grow as counting completes.
The same address or person can appear more than once in a cumulative total, and no source retrieved gives a confirmed count of distinct people for this incident. The 51,628,280 figure is therefore a record count that may have leaked, not a count of affected people, and it must not be added to any JR member count, since the JR count was still being confirmed and the JR systems may already sit inside the 49 systems.
51,628,280 is a count of cumulative records, not a count of distinct people. The same address or person can appear more than once in a cumulative total.
A separate Cuenote BASE exposure, where contract customer information had been viewable, affected 190 records, reported separately from the 51,628,280 total.
Scope limits
For the 49 systems as a whole, the sources retrieved do not publish one single field list. At minimum, registered email addresses were included in the records that may have leaked, while other fields for each client system are still being confirmed or have not been published, and YmirLink does not name the client companies in its report. The detailed field list known with precision is the JR list, which applies to JR members only, not to all 49 systems.
Express Reservation and Smart EX are the online booking services for the Tokaido, Sanyo and Kyushu Shinkansen. The JR joint notice of 26 October 2026 said the members at risk were those who received emails sent through Cuenote FC, including promotional emails and notices about departure time changes after the Kumamoto earthquake. A second Kyodo report that evening covered the JR train reservation users. The notice listed four leaked items for each affected member: email address, member ID, name written in katakana, and membership type, and items with no possibility of a leak: names in other forms, dates of birth, addresses, phone numbers, and credit card numbers and expiration dates. No leak was confirmed from the Express Reservation and Smart EX systems held by JR Central itself.
The JR timeline also revised an earlier position. When YmirLink was hit on 16 October, it told the railways that Express Reservation and Smart EX customers were not affected. Ten days later, on 26 October, it informed them that customers' personal data had been viewed or obtained by a third party. The railways stopped using the email service immediately, reported the case to the Personal Information Protection Commission on 26 October, and said affected customers would hear from them individually. The JR member count was still being confirmed, so no JR number is given here.
Response and notifications
YmirLink notified the Tokyo Metropolitan Police Department and reported the leak to the Personal Information Protection Commission. As of the second report update, YmirLink said it had not confirmed that leaked personal data had been made public or misused. The company also warned of spam sent from its own domain under third parties' names, citing messages from info@cuenote.jp that used the Saison card name, so a message appearing to come from a known brand through a known mail service could still be impersonation mail.
Summaries of the first report describe a software vulnerability that gave attackers support and quality control staff service credentials, followed by a malicious program and the copying of data. Undercode News summarised the first report in the same terms. That description is attributed to summaries of the company notice, because the primary notice text was not directly retrievable for this article. No source retrieved attributes the incident to a named threat actor or reports a ransomware element.
Client disclosures continued after 26 October. The Resona group banks, Resona Bank, Saitama Resona Bank and Kansai Mirai Bank, announced that customer information including email addresses may have leaked through the YmirLink service, that account numbers and PINs were not included, and that no unauthorised use had been confirmed at the time. That detail is included as reported announcements only, because the banks' own notices were not directly retrieved for this article.
Email delivery service pattern
Japan Cyber Watch summarised three such email delivery services breached in a month, including YmirLink. Companies that send newsletters, alerts and notices hand mailing lists to specialist services, and those services hold lists of real, active addresses, the sender reputation that gets mail past spam filters, and the brands their customers send under. The technical details of one vendor breach do not transfer to another vendor breach.
Japan Cyber Watch summarised three such services breached in a month. Arcadia, whose SpeeCAN RAIDEN service sends disaster alerts for local governments, disclosed on 13 October 2026 that up to 3.14 million email addresses may have been exposed and that its system was used to send 1.42 million phishing emails. Blastmail, run by a Rakus subsidiary, stopped completely on 21 October 2026, with delivery lists and other sending data leaking for 344 customer contracts according to its 24 October update. The directory traversal, configuration secret and brute-forced identifier details reported for Arcadia and SpeeCAN describe Arcadia, not YmirLink, and no source retrieved states that YmirLink was breached by the same route.
AliasFleet provides one email alias per service, so a leak from one service points back to that service and that alias can be paused or closed without changing the address used everywhere else. That product fact has a limit that applies directly to this incident: an alias does not remove an address from a leak that has already happened, and it does not stop mail already sent through a compromised vendor.
Measures for affected members
Published guidance describes several measures for affected members. Affected members were advised to treat unexpected mail with caution, even when the sender domain looked familiar, because YmirLink warned that spam had been sent from its own domain under third parties' names. Messages asking the recipient to log in, confirm card use, or follow a link were to be verified through a separate channel, such as the official site or an installed app, rather than through the link in the message.
A second measure was checking whether an address appears in known leak collections. Have I Been Pwned is the public collection most often cited for that check, although a new incident may not appear there immediately, so absence from the collection at one date does not establish that an address was unaffected. A third measure was password work on accounts that shared a password with the affected address, with the password changed on each reusing account. A fourth measure was learning the signs of impersonation mail, because the JR fields, an address plus a member ID and a katakana name, are sufficient to write a convincing targeted message. How phishing uses a leaked email address describes that mechanism, and how to check whether an email is phishing describes the checks applied before any link is opened.
Members who received a direct notice from the railways or another client company were told to follow that notice, because only the client company can confirm whether a given member was in the affected mailing. Members who received no direct notice have no confirmed basis in the sources retrieved for treating themselves as affected or as unaffected.
If a Cuenote FC mailing list held your address, it may be in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Investigation status
The investigation was still open at the time of the second report. Counting continued for 16 of the 49 Cuenote FC systems, so the cumulative total may rise. The JR member count and other fields per client system, beyond the JR list and the minimum of email addresses, were still being confirmed or had not been published.
Later reports may revise these figures and will supersede them for those items. Until then, the figures here stand only with the hedges stated alongside them. The open items are the completion of the 16 system counts, the confirmation of the JR member count, the publication of field lists for the remaining client systems, and whether leaked data was made public or misused beyond the position stated on 26 October.
Top comments (0)