2026 Japan Post — CBcloud PickGo vendor; 3,763 names (1,672 full, 2,091 surname only)
Data compromised
Customer names for some jobs CBcloud handled in December 2025–March 2026 and September 2026: 1,672 full names and 2,091 surnames only (3,763). Addresses and phone numbers not included. No misuse reported as of the notice. PPC notified.
Technical writeup
Japan Post notice 5 Nov 2026. Names only. Catalogued on Japan Post (customer-facing operator), not double-counted as a CBcloud people census.
Root cause
Unauthorised access on 1 November 2026 to CBcloud's PickGo dispatch system, used for some Japan Post pickup and delivery jobs. Japan Post was told 2 November; leak confirmed 4 November. CBcloud blocked the source, disabled abused accounts and patched the flaw; some functions and overseas access restricted.