Nearly 47.86 million recipient records leaked from 49 Ymirlink email systems
Forty-nine customer-specific systems for Japanese company Ymirlink's Cuenote FC email delivery service were compromised. Investigation findings released on 11 November 2026 confirmed that 47,864,147 recipient records had been leaked, a total that includes duplicates rather than a count of unique victims. Attackers were found to have installed malware through vulnerabilities and misused the legitimate CSV export function after hijacking login sessions, while personal information held by some customers and approximately 420,000 unencrypted passwords from a discontinued service were also leaked.
Key facts
- Affected organisation
- Ymirlink
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- 47,864,147 recipient records across 49 systems, including duplicate entries; approximately 420,000 unencrypted passwords also leaked
- Cause / method
- The compromise spread through vulnerabilities and a shared maintenance account; attackers installed malware and misused the CSV export function using hijacked login sessions
- Location
- Japan
If your data was exposed
Exposed dataEmailUsernameNameDate of birthAddressPassword
- Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- It was reported that a cumulative total of 51,628,280 records may have been leaked from 49 Cuenote FC systems.
- The leak was confirmed to involve 47,864,147 records, including duplicates, and the attack methods and additional password leak were disclosed.
5 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.