Breaches and incidents
Yamato Transport: Kuroneko deferred payment service breached, about 5.26M user records exposed
Yamato said a third party accessed the Kuroneko pay-later service (detected 28 Sep).
- Disclosed
- Verification
- Checked against a primary source
What happened
- Yamato said a third party accessed the Kuroneko pay-later service (detected 28 Sep); its 16 Oct fourth report lists about 5.26M service-user records (name, address, phone, email for about 490,000, purchase details) from Oct 2018 onward, about 50,000 recipient records and about 4,100 merchant records; no card data or passwords.
- Root cause: not disclosed.
- No attacker named.
- External access was restricted, the PPC notified and a specialist firm investigated; the service resumed 9 Oct; no misuse confirmed.