Yamato Kuroneko Pay-Later Breach: 5.31 Million Records

Tue Oct 27

September 28 to October 16, 2026: Yamato Transport confirmed unauthorised access to its Kuroneko pay-later service (クロネコ代金後払い) and reported that about 5.31 million records were taken. Buyer, recipient and merchant data is included. Canonical: yamato-kuroneko-paylater2026. Primary source: the company's announcement as reported by Nikkei.

Kuroneko pay-later lets online shoppers pay for a parcel after delivery, which is why the service holds purchase details, delivery addresses and merchant records. The service was shut down after the intrusion and restarted on October 9. Yamato has not said how the attacker got in.

What happened

September 28: Yamato confirmed unauthorised access to the service and stopped it that night.
September 29: the first public notice was issued.
October 9: the service restarted.
October 16: Yamato published its findings, with a total of about 5.31 million records.

Technical analysis

The company has not described the entry point, the method or the period in which the attacker had access. An earlier warning that employee names might have been exposed was not confirmed by the investigation. Yamato says the attacker did not take credit-card numbers or account passwords.

Press coverage of the notice did not add a method, so anything beyond the facts above would be speculation and is not included here.

Impact

The 5.31 million total is made up of three groups:

About 5.26 million buyer records going back to October 2018. These include name, address, phone number, purchased-item details, application number and internal management data. About 490,000 of them include an email address.
About 50,000 delivery-recipient records.
About 4,100 merchant records.

The total adds up records, not people. A buyer who appears in several records is counted more than once, so the figure is not a count of unique individuals. Yamato says it has seen no misuse of the data so far.

Verified vs unverified

Verified (company): the confirmed unauthorised access, the service shutdown and restart dates, the 5.31 million total, the three record groups and the exclusion of card numbers and passwords.
As reported by press: the breakdown by record type and the email count are taken from Japanese news coverage of Yamato's findings. We did not retrieve the company release itself.
Not confirmed: the entry route, whether the data has been published or sold, and whether any buyer has been defrauded.

What to do

Expect delivery-themed scams. Messages that quote a recent parcel, a delivery fee or a failed delivery are the obvious lure for someone holding a buyer's address and purchase history.
Do not pay a delivery fee through a link in a text or email. Go to the courier's official app or site and check the status there.
Check whether you used Kuroneko pay-later between October 2018 and September 2026 by looking at your order history with the merchant or the service. If you did, expect the company's individual contact.
Change the password on the merchant or shopping accounts where you used the service, and do not reuse it elsewhere.
Watch for requests for card details or passwords. Yamato says card numbers and passwords were not part of the data, so a message asking for them is suspicious on its face.

What the figure does and does not mean

A figure of 5.31 million records describes the rows that were copied, not the number of distinct people affected. One buyer can have several purchase records going back to 2018, and a recipient can appear in more than one delivery. That is why the company's breakdown matters more than the headline total. Anyone who wants to know whether they are included should expect an individual message from the company rather than rely on the number. The breakdown is more useful than the total for judging whether a given record type applies to you.

For the roughly 11 days the service was down, shoppers who wanted to pay later at checkout could not do so. The sources reviewed for this post do not describe how orders placed during that outage were handled.

The service also holds merchant records, about 4,100 of them. Those belong to the businesses that offer pay-later at checkout, so the exposure reaches merchants as well as buyers.

Why pay-later data is sensitive

A pay-later record links what was bought, where it was sent and under which name. A criminal with that combination does not need a password to write a convincing delivery message. Yamato says card numbers and passwords were not part of the stolen data. That lowers the direct financial risk, but it does not remove the risk of a targeted lure built from the rest of the record.

Sources

Nikkei • ITmedia NEWS, October 16, 2026 • Impress Watch, October 2026