Japanese delivery giant Yamato Transport has confirmed that attackers stole about 5.3 million customer and delivery-destination records from its Kuroneko deferred payment service.
The company said an investigation with external security specialists confirmed the data theft after it detected unauthorized access on September 28. After discovering the intrusion, Yamato restricted external access and reported the incident to Japan’s Personal Information Protection Commission.
Yamato operates Japan’s leading parcel delivery network. Its parent group reports about 170,000 employees and handled around 2.3 billion parcels in the financial year ended March 2026.
The affected service lets shoppers receive purchases before paying through a subsequent bill, with payment options including convenience stores and post offices. Yamato pays participating retailers upfront and then collects the money from buyers.
Contact information and purchase details stolen
The largest affected dataset contains approximately 5.26 million customer records covering October 1, 2018, through September 28, 2026. The exposed information includes names, addresses, telephone numbers, and purchase details such as product names, quantities, and unit prices.
The data also included internal administrative information, including application numbers, order dates, and credit authorization numbers. Approximately 490,000 of these records additionally contain email addresses.
A separate dataset contains around 50,000 delivery destination records from February 5, 2021, through September 28, 2026, exposing recipients’ names, addresses, telephone numbers, and shipment tracking numbers.
Attackers also obtained approximately 4,100 merchant records containing business names and internal merchant codes, covering the same period as the main customer dataset.
These figures describe records; Yamato has not specified how many unique individuals were affected.
The company said the stolen information does not include credit card details or passwords. Investigators also found no evidence that billing amounts, outstanding receivables, or employee names had been taken, revising concerns raised in an earlier update.
Yamato said it found no evidence that information was stolen from other services, including its Kuroneko Members consumer program and Yamato Business Members platform.
Suspicious messages reported
Although Yamato has received inquiries about unfamiliar emails, text messages, and telephone calls, it said it has not confirmed any harm resulting from the misuse of the stolen information.
Nevertheless, the combination of purchase details, delivery information, and contact data could help scammers make fraudulent payment requests or delivery notifications appear convincing.
The deferred payment service resumed on October 9 following a temporary suspension. Yamato also extended payment deadlines by 17 days for payment slips with deadlines falling on or after September 28.
The company plans to contact affected customers and merchants individually where possible and, on advice from external specialists, strengthen security.
Customers should avoid links and attachments in unexpected messages, verify payment requests through independently accessed official channels, and treat unsolicited calls or postal notices cautiously.
Leave a Reply