2026 YMIRLINK (Cuenote) — exploited software flaw and stolen staff credentials; cumulative record counts across 49 systems; data types not specified
Data compromised
Not specified in the reports reviewed. The company's cumulative per-system counts total 51,628,280 across 49 systems; these are not unique people, and counting for 16 systems was still ongoing.
Technical writeup
Sourced from Japanese reports of the company's second notice (October 26); the notice itself was not fetched. Some reports misspell the company as Yumilink.
Root cause
YMIRLINK, which runs the Cuenote email and SMS delivery platform, says an attacker exploited a software vulnerability on October 16, 2026, stole staff credentials, and used malware to export databases. It first reported five systems and expanded the count to 49 systems on October 26.