2026 Rakus Light Cloud (Blastmail) — third party reached two API servers and took customer data from a sales-management system; delivery lists leaked; downstream newsletter exposures
Data compromised
Customer data held by the sales-management system: business names, contact people, phone numbers, email and billing addresses, and contract and payment history. A subset of customers’ delivery lists also leaked. Card numbers are not held by Rakus and were not included.
Technical writeup
The company confirmed unauthorised access by an outside third party and that customer data was taken. Downstream organisations, including Piccoma, have reported newsletter subscriber exposures tied to this incident, and some of those figures are reported as possible rather than confirmed. Piccoma reported about 1,002,404 email addresses exposed from one newsletter send, while stating its own systems were not breached. Most of this detail is from Japanese reporting and secondary analysis, and the primary Rakus and Blastmail notices were not retrieved. recordsAffected 0 because no company count was found.
Root cause
A third party gained access to two API servers, ran commands on them and pulled data from a sales-management system. Blastmail was suspended at 00:30 JST on October 21 after suspicious activity. Seven sibling products were paused as a precaution and were restored on October 22 after checks found no evidence of compromise. The entry vulnerability has not been named.