2026 Yamato Transport — Kuroneko pay-later service intrusion; about 5.31 million buyer, recipient and merchant records taken
Data compromised
About 5.26 million buyer records going back to October 2018 (name, address, phone, purchased-item details, application number and internal management data; email addresses for about 490,000 records); about 50,000 delivery-recipient records; about 4,100 merchant records. Yamato says credit-card numbers and account passwords were not included.
Technical writeup
Yamato issued a first notice on September 29, 2026 and a findings report on October 16 with the 5.31 million total. The total adds buyer, recipient and merchant records, so it is not a count of unique people. Yamato has not said the data has been misused. An earlier warning that employee names might have leaked was not confirmed by the investigation. The company’s own press release was not retrieved; the figures come from Japanese press coverage (Nikkei, ITmedia, Impress Watch). companyConfirmed true.
Root cause
Unauthorised access to the Kuroneko pay-later (クロネコ代金後払い) service, confirmed on September 28, 2026. The service was stopped that night and restarted on October 9. Yamato has not said how the attacker got in.