One email vendor was breached, and member data from dozens of its clients went with it

At a glance

The Ymir Link Cuenote data breach is a textbook third-party vendor breach: the email vendor was hacked, but dozens of its client companies had to apologize to their own customers. When the company that sends your email is breached, the notices, the apologies and the report to Japan's privacy regulator still go out under your name. What you can check today is which vendors hold your customer lists, whether a vendor's report means "not confirmed" or "not affected," and whether you hand over more fields than you need. In October 2026, Ymir Link (ユミルリンク), which runs the bulk email service Cuenote FC, disclosed unauthorized access. Address books that client companies had uploaded to send email were taken from 49 systems: 51,628,280 records counted on a nobe (延べ) basis, about 51.63 million. Nobe is a cumulative count where the same person can be counted more than once, so this is not a number of people. JR Central, JR West and JR Kyushu (JR東海・JR西日本・JR九州), banks, card companies, newspapers and local governments followed with apologies.

When

• Ymir Link first noticed something wrong on the morning of October 16, 2026. It published a first report on October 19 and a second report on October 26.
• As of November 4, 2026, there is no third report from Ymir Link.

Who

• Ymir Link, listed on the Tokyo Stock Exchange Growth market. It runs Cuenote FC, a bulk email service used by companies and local governments, and Cuenote BASE, a customer portal.

What leaked and how much

• Cuenote FC: 51,628,280 records (nobe) from 49 systems, each dedicated to a single client company. The shared systems used by several companies leaked 0 records.
• What leaked: recipients' email addresses and the attributes each client had added (such as name, prefecture and date of birth; this differs by company), delivery logs, newsletter sign-up logs, and contact details of the client companies' own staff.
• Cuenote BASE: 190 records of contract-holder information (company name, name, phone number, email address) were visible to other users.
• 16 systems are still being counted. The number may grow.
• Nobe counts the same person every time they appear. It is not a count of people.

Why (official statements only)

• The attacker came in through a vulnerability in a program library (shared code that many programs use).
• The attacker then obtained the credentials of support and quality-control staff, planted malicious programs and read out the databases. The attacker also tried to use the same credentials to get into other systems.

Where things stand now

• Client companies' notices came in a cluster from October 26 to October 30. Many had first been told they were not affected, and that changed on October 26.
• Ymir Link said that, as of its second report, it had not confirmed that the leaked data had been published or misused. But phishing emails pretending to come from the Cuenote domain were already going around.

What to check in your own company today

1. List every place where you hand customer lists to an outside service: email delivery, surveys, event registration. Include the services your agencies use.
2. If a vendor first says "no impact," do not pass that on to customers as is. In this case, answers flipped several times within about ten days. Ask first: is it "not confirmed" or "no impact"?
3. Cut down the fields you put in your mailing lists. Data you never upload cannot leak.
4. Change the passwords of your admin accounts on outside services and turn on two-factor authentication.
5. Prepare, in advance, the message you will send customers if fake emails using your company's name start going around.

What exactly happened?

Here is the timeline, based on Ymir Link's first report¹ and second report². Times are Japan time.

• October 16 At 6:49 a.m., an employee noticed something wrong with their own account on "System 01." At 10:10 a.m., the company identified a library vulnerability as the way in and blocked suspicious IP addresses. At 8:10 p.m., it found that the customer portal Cuenote BASE was showing other users' information, and shut it down. It applied a patch at 8:46 p.m.
• October 17 It found a malicious program on System 02 and stopped it. It began checking all systems and brought in outside security experts.
• October 18 Malicious programs turned up on Systems 03, 04, 05 and 07. On System 04 there were traces of unauthorized logins with support and quality-control staff accounts. The company stopped every system in that data center as a precaution, and put IP restrictions on the login screens and the API (the channel programs use to exchange data).
• October 19 It reported to the Tokyo Metropolitan Police Department and to the PPC, Japan's Personal Information Protection Commission (the privacy regulator), and published its first report. At that point the figure was "5 systems, about 9 million records (nobe) including email addresses."
• October 20 It restarted the systems it had stopped. That night it confirmed that the attacker had also reached System 08 by way of System 03.
• October 22 It started going back through the login and operation logs of all systems.
• October 25 At 9:45 p.m., it confirmed unauthorized access and data removal on 42 more systems.
• October 26 It contacted the affected client companies by 12:30 p.m. and published its second report at 5:00 p.m. The figure grew to 51,628,280 records (nobe).
• As of November 4 There is no third report. The latest item on the Cuenote incident page³ is still the October 26 second report.

Ymir Link fixed the vulnerable program, deleted the support and quality-control staff accounts, and put IP restrictions on the login screens and the API. It reported to the police, the PPC and JIPDEC (the organization that runs Japan's PrivacyMark data-protection certification). It asked its clients to change their Cuenote passwords, to change the same password anywhere else they used it, and to turn on two-factor authentication.

It also warned about fake emails. Phishing emails went around that appeared to come from info@cuenote.jp, with a card brand as the display name. Ymir Link said they had nothing to do with the company. On the effect on its earnings, it said only that this was under review.

The client companies each published notices, sent individual emails and reported to the PPC. Many stopped sending email for a while. The Mainichi Newspapers (毎日新聞社) stopped twice.

What leaked, and how much?

Based on Ymir Link's second report:

• Cuenote FC dedicated systems (one per client company): intrusion attempts on 78 systems, traces of data leaving 49 systems, 51,628,280 records (nobe).
• Cuenote FC shared systems (used by several companies): intrusion attempts on 3 systems, 0 records leaked.
• Cuenote BASE: 190 records of contract-holder information were visible.
• Types of data: address books (email addresses plus attributes such as name, prefecture and date of birth), delivery logs (including email addresses), newsletter sign-up and member-page change logs, and the client companies' own staff details (name, email address, postal address, phone number).
• Services Ymir Link said were not affected: Cuenote SR-S, SMS, Auth, Survey, Push, and its safety-confirmation service.

What each client put in its address book was different. So the only way to know what leaked about a given company's customers is to read that company's own notice. For example, The Asahi Shimbun Company (朝日新聞社) said more than 90% of its entries were email addresses only. DCM Holdings (DCMホールディングス), a home-center retailer, said names, gender and year and month of birth leaked too.

Does "51,628,280 records (nobe)" mean 51 million people were affected?

No. A nobe count is cumulative. If one person is signed up for three newsletters, that person is counted three times. It is closer to "how many rows of records left" than to a number of people.

The client notices show the gap. ValueCommerce (バリューコマース) gave two numbers for the same data: 6,096 records with duplicates removed, and 7,588 records with duplicates included⁴.

You also should not add up the client companies' numbers. There are four reasons.

1. They are already inside the total. The 49 systems are client-dedicated systems. Each client's number comes out of the 51,628,280 records. Adding them counts the same data twice.
2. The units are different. Some notices count records, some count people, some count registrants, some count affected contracts, and some use nobe records or nobe people. People, contracts and cumulative records cannot be added together.
3. The counting is not finished. 16 systems are still being counted, and many clients still say their numbers are "being confirmed."
4. Even a sum across clients is not a number of people. One person who gets email from several companies appears several times.

So in this article I do not add the client numbers together, and I do not add them to Ymir Link's figure.

Why do news reports give different numbers?

Three reasons.

• The first and second reports differ. The first report said about 9 million records (nobe) from 5 systems. The second said 51,628,280 records (nobe) from 49 systems.
• "50 systems" and "81 systems" are calculated numbers. The "50 systems" in news reports⁵ is the 49 Cuenote FC systems plus 1 for Cuenote BASE. "81 systems" is the 3 shared systems plus the 78 dedicated systems with intrusion attempts. Neither total appears as such in the second report's table.
• Client numbers were corrected. Animate (アニメイト) first said gender, prefecture and member code had also leaked, then corrected this to email addresses only. Cybozu (サイボウズ) also corrected its number. Articles that repeated the first notices still carry the old information.

Which companies were affected by the Cuenote breach?

There is no confirmed count of affected client companies, so I write "dozens." Below are the largest figures that companies had published in their own notices by November 4. The units differ, so treat the comparison as rough.

• Retail: DCM Holdings 753,272 people; Animate 140,443 people (email addresses only)
• Entertainment: Bandai Namco Entertainment (バンダイナムコエンターテインメント) and BANDAI SPIRITS, "THE GUNDAM BASE MEMBERS," 346,247 records
• Cards: Lifecard (ライフカード), 339,610 affected contracts
• Newspapers and publishing: The Asahi Shimbun Company 70,921 records (nobe); Impress (インプレス) about 58,000 records; The Mainichi Newspapers 2,328 records (nobe)
• IT and telecoms: NTTPC Communications (NTTPCコミュニケーションズ) 60,929 records; Cybozu 23,392 records
• Industry groups: PRAISE-NET, run by four pharmaceutical industry associations, 30,750 records (email addresses only)
• Local governments: Saitama Prefecture (埼玉県) 669 registrants; Mie Prefecture (三重県) 156 people (nobe)

Many have not yet given a number. These include JR Central, JR West and JR Kyushu for members of their Express Reservation and smart EX train booking services; the three Resona group banks (りそな銀行・埼玉りそな銀行・関西みらい銀行); Nomura Securities (野村證券); SOURCENEXT (ソースネクスト); Sendenkaigi (宣伝会議); Asmarq (アスマーク); JMA Management Center (日本能率協会マネジメントセンター, JMAM); and istyle (アイスタイル), which runs @cosme. Sendenkaigi published its own announcement through PR TIMES⁶.

Some cases appear only in news reports. According to ABC News⁷, 28,052 member email addresses of the card company Persona (ペルソナ) are involved. As of November 4, I have not found a notice from the company itself.

Local governments were hit even though they did not use Cuenote themselves. Saitama Prefecture was affected through its contractor Knowledge Climber (ナレッジクライマー), and Mie Prefecture through its contractor Sankei Living Shimbun (サンケイリビング新聞社). Satofull (さとふる), a site for Japan's hometown tax donation program, also told local governments that it used Cuenote FC for some of its email. A security news roundup⁸ counted 31 local governments that had posted warnings as of its October 28 article. A warning does not mean that donor data for that local government leaked.

Why did companies first told "not affected" later announce damage?

This is the part of the case I would watch most closely. The three JR companies were told "no impact" on October 16. The Resona banks were told "no data removed" on October 21. Cybozu was told "not affected" on October 20, and PRAISE-NET on October 19. JMAM received a report on October 20 that no leak had been confirmed. On October 26, all of these were reversed.

The reason is that Ymir Link started going back through the logs of all systems on October 22 and found 42 more systems on the night of October 25. In its second report, Ymir Link wrote that for "customers we have not contacted individually, no leak of information from their environment has been confirmed at this time" (当社から個別連絡のないお客様については現時点でご利用環境の情報漏洩が確認されておりません). "Not confirmed" is not the same as "none." 16 systems are still being counted.

Why did it happen?

Ymir Link described the sequence like this.

1. The attacker exploited a vulnerability (a security hole) in a program library.
2. The attacker obtained the credentials (login information such as IDs and passwords) of support and quality-control staff.
3. The attacker planted malicious programs, read the contents of the databases and sent them out.
4. The attacker stole session information (the data that keeps you logged in) and used it to log in.
5. The attacker tried to use the same credentials to get into other systems.

One hole spread through staff accounts to many systems. The notices do not say who the attacker was or whether money was demanded. Ymir Link has not said which library it was.

Was AI used in this attack?

There is no official announcement or news report saying AI was used in this incident.

But it has already been shown that AI can find weak points and even build the attack. This is what people call AI cyber attacks: attackers using AI to find weak points.

• Anthropic announced⁹ that its model Claude Mythos Preview found thousands of high-severity vulnerabilities in major operating systems and web browsers. The model has not been released to the public (evaluation details¹⁰).
• The security company Wiz said¹¹ it used AI to find "PHP2Shell," a remote code execution vulnerability in the PHP engine. Amazon observed¹² attempts to exploit it four days before it was made public.
• In the same October, GMO Cybersecurity by Ierae (GMOサイバーセキュリティ byイエラエ) announced¹³ that ARTEX, an AI penetration-testing tool, was found on attack infrastructure that targeted about 20 Japanese companies. The announcement does not name any victim companies, Ymir Link included.

From here on, this is my interpretation. I am not saying AI was used in this incident.

I see this case as a small hole in one library that was climbed like a ladder: from the library to staff accounts, and from staff accounts to many systems. Holes like this used to be hard for human eyes to find. I think AI can now find them in a short time.

I read the Glasswing announcement above as an attempt by defenders to use AI to find holes first and close them. But attackers use the same weapon. Just as we use AI to solve our problems, attackers use AI to find where to hit us. AI made work easier, and it made hacking easier too. I think cyber attacks are likely to keep increasing.

Here is something I saw myself. I was building a security-check tool with AI. Claude showed me a message I had never seen before. It said that building this kind of tool with the higher models (Opus 5.5 and above) was not allowed, and asked me to choose between building it with a lower model or stopping. Because of Mythos and Glasswing, I take this as Anthropic being careful one step ahead. I think it matters to know that the companies building AI are this cautious.

So I think we should prepare on the assumption that people with bad intentions are using AI like this. Attacks that start from a hole in one library, like this one, may come more often as the speed of finding holes goes up. AI has made our work easier. That is why we need to pay closer attention now.

Why does a third-party breach put you at risk even if your own systems are secure?

Nothing inside your own company has to be broken for this to happen to you. When the damage reaches you through a company you hired, not through your own systems, it is called a supply chain attack. An address book you upload to an email vendor is still your customer data. In this case, the client companies apologized to their customers one by one, each under its own name.

An email marketing platform breach also hands attackers something useful: the fact that "this person is a customer of this company." At some companies, member IDs, names in katakana (the Japanese phonetic script), contract plans or card names leaked along with email addresses. With that, a fake email pretending to come from that company becomes much more convincing. DCM Holdings told customers not to respond to any email that asks for a password or card number, even if it seems to come from DCM's official sender address, because the sender display can be faked.

Who is responsible when your email vendor is breached?

The breach was at Ymir Link. But the notices to customers, the individual emails and the reports to the PPC came from each client company, under its own name.

Japan's privacy law expects this. Article 25 of the Act on the Protection of Personal Information requires a business that outsources the handling of personal data to exercise "necessary and appropriate supervision" (必要かつ適切な監督) over the contractor. The PPC's guidelines (General Rules volume)¹⁴ explain this in section 3-4-4 as supervision of contractors.

The chain can be longer than one vendor. Saitama Prefecture and Mie Prefecture did not use Cuenote themselves. Their contractors did. So the list you keep should include what your PR and event agencies use, not only the vendors you signed with directly.

What should a company check when its email vendor is breached?

Listen to the vendor's words carefully. I treat "not confirmed," "no impact" and "not affected" as three different states. Not having counted yet is different from having counted and found zero. It is the same as the difference in IT between null (no value yet) and 0 (counted, and the value is 0). In this case, too, the first "no impact" and "not affected" answers were reversed on October 26. I think you should record, inside your company, exactly which words the vendor used.

Decide in advance how you will tell real emails from fake ones. Bandai Namco told customers ahead of time that emails about this incident would not contain any URLs. That gave customers a rule for spotting fakes before the fakes arrived.

Check what you hand over. DCM Holdings did not use passwords or point information for email delivery, so those were not part of the leak. Data you never upload cannot leak.

What does this mean for your business?

My view is that it is natural for the responsibility to stay with us. Customers did not give their information to the email vendor. They gave it to us, because they trusted us. So when a vendor we chose has an incident, we carry the responsibility, and we handle the response, including the report to the PPC. Now is the time to pay close attention to how we manage our vendors.

I am writing up five Japan data breach 2026 cases, and this one shows the vendor risk most clearly to me. None of the client companies in this case was breached directly. The way in was one library at one vendor. Open your own mailing list today and check that it holds only the fields you really need.

What happened (based on official announcements)

Times are Japan time.

• October 16, 2026 6:49 a.m.: a Ymir Link employee noticed an account anomaly on System 01. 10:10 a.m.: the way in was identified as a library vulnerability, and suspicious IP addresses were blocked. 8:10 p.m.: Cuenote BASE was stopped. 8:46 p.m.: a patch was applied. — Ymir Link second report²
• October 17, 2026 4:43 a.m.: a malicious program was found and stopped on System 02. A check of all systems began, and outside security experts were brought in. — Ymir Link second report²
• October 18, 2026 Malicious programs were found on Systems 03, 04, 05 and 07. Unauthorized logins with support and quality-control staff accounts were found on System 04. All systems in that data center were stopped, and IP restrictions were put on the login screens and the API. — Ymir Link second report²
• October 19, 2026 Reported to the Tokyo Metropolitan Police Department and the PPC. First report: estimated removal of about 9 million records (nobe), including email addresses, from 5 systems. — Ymir Link first report¹
• October 20, 2026 Reported to JIPDEC, and the stopped systems were restarted. 9:29 p.m.: unauthorized access to System 08 by way of System 03 was confirmed. — Ymir Link second report²
• October 22, 2026 A review of the login and operation logs of all systems, going back in time, began. — Ymir Link second report²
• October 25, 2026 9:45 p.m.: unauthorized access and data removal were confirmed on 42 more systems. — Ymir Link second report²
• October 26, 2026 The affected client companies were contacted by 12:30 p.m. 5:00 p.m.: second report: 51,628,280 records (nobe) from 49 Cuenote FC dedicated systems, 0 records from shared systems, 190 records on Cuenote BASE, 16 systems still being counted. — Ymir Link second report², Cuenote incident page³
• As of November 4, 2026 No third report from Ymir Link. — Cuenote incident page³

Companies that disclosed damage and what leaked

All dates are in 2026.

Companies that announced no impact, or that they could not confirm their data was included: SBI Shinsei Bank (SBI新生銀行; its environment was not in scope, October 26, sbishinseibank.co.jp³⁵), Katabami (かたばみ; no leak confirmed, October 26, katabami.co.jp³⁶), the Transport Digital Business Council (運輸デジタルビジネス協議会, TDBC; no leak confirmed as of October 20, tdbc.or.jp³⁷), and Kakuyasu (カクヤス; no information confirmed as included in the damage, updated October 22, kakuyasu.co.jp³⁸). Each of these reflects the company's view on the date of its notice.

The figures use different units and cannot be added together. The client companies' figures are part of Ymir Link's 51,628,280 records (nobe).

Reference date: November 4, 2026. Each company's notice may change later.