November 5, 2026: Japan Post said unauthorised access to contractor CBcloud's PickGo dispatch system leaked 3,763 customer names — 1,672 full names and 2,091 surnames only. Addresses and phone numbers were not included. The catalog entry records that names-only census.
What is known
- PickGo was accessed on 1 November 2026. CBcloud told Japan Post on 2 November; the leak was confirmed on 4 November. The jobs in scope are some pickups and deliveries CBcloud handled for Japan Post in December 2025–March 2026 and in September 2026.
- No misuse had been reported as of the notice. Japan's Personal Information Protection Commission has been told. Japan Post will write to matched customers.
- CBcloud blocked the source, disabled abused accounts, patched the flaw, and restricted some functions and overseas access.
What is not known
- Whether CBcloud's own shipper and driver files, beyond this Japan Post slice, contain more fields. That would be a separate census; it is not in Japan Post's 3,763.
- How the actor got in, and whether the name list has been posted.
- When letters will arrive. Unmatched senders should not assume they are clear until the letter window closes.
Names without addresses are a small take. They are still enough to personalise a fake "your parcel is held" SMS if the actor later matches a number from another file.
Who is at risk
People whose Japan Post pickup or delivery in those months was handled by CBcloud/PickGo. Ordinary Japan Post traffic that never touched PickGo is outside this notice.
What to do
- Watch for a Japan Post letter. Do not pay a "redelivery fee" demanded by SMS or a parcel-locker page you did not open from the official app.
- Use Japan Post's own tracking site. CBcloud/PickGo mail about this incident is not a reason to hand over a second ID.
- If you are a PickGo shipper or driver, read CBcloud's own notices; your file may not be the Japan Post names-only set.
- A name leak does not justify a credit freeze on its own. It does justify ignoring parcel phishing that quotes your real surname.
- Keep the notice if it arrives. If Japan Post later adds addresses or phones, that update changes the risk.
Sources
Sourcing note: 3,763 and the full-name / surname split are Japan Post's. We will update this post if CBcloud publishes a wider people census.