Who this is for: people who receive newsletters or notification emails from companies and organizations, and organizations that use blastmail, the email delivery service of RAKUS Lite Cloud Co., Ltd. This article is based on the official notices of RAKUS Lite Cloud, its parent company RAKUS Co., Ltd., and the client organizations that disclosed impact. It does not cover how the attack was carried out.
Developing: this article will be updated as the organisation publishes more
As of the update at 13:20 on October 24, 2026Not yet known
- Details of the intrusion route
- Which client organizations the 344 contracts are (the company has only contacted them individually)
- Which recipient data items leaked, and how many, for each contract
- When the service will restart
- Whether any secondary harm (misuse of data) has occurred
RAKUS Lite Cloud says an external investigation by a specialist organization is continuing and that its next report is planned for around 10:00 on Sunday, October 25. It says it will keep reporting over the weekend. It describes the figure of 344 as a "current" number that may change as the external investigation progresses.
What newsletter recipients should do today
Do not open links or attachments, even in emails with the sender's real name
The addresses that blastmail sends to sit in recipient lists registered by the sending organization. So if the data is misused, the likely form is fake emails using the real sender's name.
Even for emails such as "Please confirm your member details", "Your points are expiring" or "Delivery has resumed", do not open links, attachments or QR codes in the message. To check, open the official app or an official site you have bookmarked (how to spot fakes: What is phishing?).
Check the notices of the organizations whose newsletters you receive
Open the notices of the organizations you receive newsletters from in the "Client organizations that disclosed impact" table below. For organizations not in the table, check the news section of their official site. JR Shikoku says it will send an apology email to people who may be affected once it is ready.
Do not enter a password, verification code or card number when asked
RAKUS Lite Cloud says it does not hold credit card numbers. Even so, someone who knows your name and email address can write an email asking you to enter them. JR Shikoku asks people not to open URLs in suspicious emails or text messages and not to enter passwords, verification codes and similar.
Be especially careful with 'sender' emails while their newsletters are stopped
The Niigata Nippo, the Ministry of the Environment, JR Shikoku and others say their email delivery through blastmail has stopped. If, during this time, you get an email in their name saying "delivery has resumed" or "please update your registration", confirm the restart in the official site's news first. The Niigata Nippo says automatic emails sent when you register or cancel membership still go out as usual from a separate system not affected by this incident, so not every email from it has stopped.
Client organizations that disclosed impact
Organizations that use blastmail have published their own notices. The list below covers only notices that this site opened and checked on each organization's official page and that name blastmail or RAKUS Lite Cloud (as of October 24, 2026).
Each status and count is given in the organization's own words. The counting units differ (people, cumulative records, registrations), so the numbers cannot be added up. The table also includes organizations, such as giftee, that announced their own contracts were not among those affected.
| Organization | What used the service (per the organization) | Data in scope (per the organization) | Count (per the organization) | Status |
|---|---|---|---|---|
| The Niigata Nippo | Newsletters, breaking-news emails and similar for Niigata Nippo Passport members | Name (katakana), prefecture, city, email address, gender, age band, subscribed product, subscribed newsletter services. Credit card details, phone numbers, dates of birth, bank account numbers and passwords not included | Up to about 253,000 people (all members) | Leak confirmed (company) |
| JR Shikoku | JR Shikoku Tour Web newsletter | Name, date of birth, address and email address entered at sign-up | About 30,000 records (maximum) | Possible (company) |
| City of Yokohama (volunteer applicants for the city's GREEN×EXPO 2027 exhibit area) | Bulk emails to applicants | Name, email address | 6,334 people | Possible (city) |
| City of Yokohama (Yokohama Women's Association for Communication and Networking) | Newsletters of the association's head office and three gender equality centers | Email address | 3,932 cumulative records (registrations at end of March 2026; may include duplicates) | Possible (city and association) |
| City of Yokohama (Shirahata District Center) | Information newsletter issued by the designated facility manager | Email address | About 200 records | Possible (ward) |
| Ministry of the Environment | Six newsletters, including the Global Environmental Outreach Centre (GEOC), the Regional Circular and Ecological Sphere and the Fukushima environmental restoration plaza newsletters | Email address; depending on the newsletter, name, attributes, affiliation, prefecture and municipality, and notes (reason for registering) | Not stated | Possible (ministry; no leak confirmed) |
| giftee | Email delivery for Tabisaki Nouzei, the e-machi platform and giftee Benefit | Tabisaki Nouzei ID and email address / local government or company name, contact name, department and email address / email address, giftee Benefit ID and company login URL | Not stated | Not confirmed (company; its contract was not among the 288 as of October 23) |
'Possible' in the table does not mean a leak has been confirmed
JR Shikoku and the three City of Yokohama items were published on October 22 as cases where data "may have leaked". The City of Yokohama's documents for the Shirahata District Center and the gender equality association say a leak "cannot currently be confirmed". The Ministry of the Environment also says no leak of recipient data has been confirmed so far. The Niigata Nippo says that on the afternoon of October 22 RAKUS Lite Cloud reported to it that the data of all members had leaked. Check whether an organization you receive newsletters from is in the table, then watch for that organization's follow-up notices.
The City of Yokohama's GREEN×EXPO document also includes a notice from the Japan Association for the International Horticultural Expo 2027. The contractor that sends bulk emails to its volunteers also uses blastmail, and the data that may have leaked is the volunteer application number, activity number and email address (the association says it did not provide names or other identifying data). Whether registered volunteers are affected has not been confirmed.
The Niigata Nippo had said in its second notice that about 7,000 Niigata Salmon Project members might be affected; its third notice said they were not among the 288, and its fifth notice said they were not among the 56 newly identified.
What happened (from the notices of RAKUS and RAKUS Lite Cloud)
The following is based on RAKUS Co., Ltd.'s first and second reports of October 21 and RAKUS Lite Cloud's notice (the version updated at 13:20 on October 24). RAKUS Lite Cloud is a wholly owned subsidiary of RAKUS Co., Ltd. The blastmail product website has been taken offline temporarily for security checks.
0:30 a.m., Wednesday, October 21, 2026
Suspicious access to the system was detected and blastmail was shut down in an emergency (the admin console and API cannot be used). Email delivery also stopped from around 1:00 a.m.October 21
RAKUS published its first report (impact and cause under investigation; reported to the Personal Information Protection Commission and the Japan Institute for Promotion of Digital Economy and Community (JIPDEC)). Its second report then said it had confirmed that an outside third party had accessed the system without authorization and taken out data including personal information. The same day, RAKUS also paused seven other services as a precaution.Evening of October 21
According to the City of Yokohama's documents, the delivery service operator reported that a leak had been confirmed for part of the recipient lists and related data of all its customers (around 5:32 p.m. for the Shirahata District Center, around 5:00 p.m. for the gender equality association).October 22
RAKUS's seven other services restarted (it said no unauthorized access or data leak was confirmed for them). Client organizations began publishing notices.October 23
A guide to joint reporting to the Personal Information Protection Commission was published (applications due October 29). According to the notices of giftee and The Niigata Nippo, the company announced that day that it had finished contacting all 288 contracts where a leak of delivery data had been confirmed.13:20, October 24
Updated to say individual contact had been completed for all 344 contracts, including 56 newly identified. Restart date not set.
Email recipients
Registered email addresses and other data with the sending organization. Leak of delivery data such as recipient lists confirmed for 344 contracts
To do: do not open links in emails claiming to be from the sender
Client organizations (customers)
Every customer's company name, contact name, phone number, email, billing address and contract and payment history were taken
To do: decide on reporting and notice; watch for fake billing emails
RAKUS Lite Cloud
Two API servers were intruded into, and the sales management system and service database were connected to
Intrusion route under investigation
- Service
- The email delivery system blastmail (provided by RAKUS Lite Cloud Co., Ltd., a subsidiary of RAKUS Co., Ltd.)
- What was confirmed
- An outside third party accessed the system without authorization and took out data including personal information
- Customer data
- From the sales management system, every customer's company name, contact name, phone number, email address, billing email address, contract and payment history and similar. The company does not hold credit card numbers
- Delivery data
- For some customers, a leak of recipient lists and similar was also confirmed: 344 contracts as of 13:20 on October 24 (may change), all contacted individually
- Cause as described
- An outside third party intruded into two API servers, ran commands, and connected to the sales management system and the service database to take data out. Details of the intrusion route under investigation
- Response
- Emergency shutdown of the service, reports to the Personal Information Protection Commission and JIPDEC, an external investigation by a specialist organization, and joint reports with client organizations
- Contact
- blastmail support center (support@blastmail.jp, phone 03-6862-7337, weekdays 10:00 to 17:00)
What is known and what is not
Status as of the update at 13:20 on October 24, 2026. When follow-up reports appear, this table's status column will be updated.
| Item | What the notices say | Status |
|---|---|---|
| Data taken out | An outside third party accessed the system without authorization and took out data including personal information | Leak confirmed (company) |
| Customer data | Every customer's company name, contact name, phone number, email address, billing email address, contract and payment history and similar | Leak confirmed (company) |
| Recipient lists and similar | Contracts with a confirmed leak of data other than customer account data (such as recipient lists): 344 (current figure) | Leak confirmed (company) |
| Which organizations the 344 contracts are | Not disclosed; affected customers contacted individually | Under investigation |
| Number of recipients | Not stated in RAKUS Lite Cloud's notices | Not stated |
| Credit card numbers | Not held by the company | Not included (company) |
| Cause | Intrusion into two API servers, running commands, and connecting to the sales management system and database | Confirmed (company); entry route under investigation |
| Intrusion route | Details under investigation | Under investigation |
| Service restart | Not set | Under investigation |
| Other RAKUS services | Seven services paused as a precaution and restarted on October 22; no unauthorized access or leak confirmed | Not confirmed (RAKUS) |
| Secondary harm (misuse of data) | Not stated by RAKUS Lite Cloud. The Niigata Nippo said in its October 22 second notice that no misuse has been confirmed | Not confirmed (The Niigata Nippo) |
What the leaked data can be used for
In general, when the following combinations are available, the following misuse can happen. This does not mean it happened in this case.
- Email address plus the sender's name: fake emails in that organization's name arrive at the same address as the real newsletter, and recipients easily assume it is "the organization that always sends me newsletters"
- Name, age band, address and similar (varies by sender): fake emails can include your real name or area, which makes them more believable than bulk spam
- Customer company name, contact name, phone number, billing email and payment history: material for fake invoices, payment-detail change requests or "log in again for the restart" emails or calls claiming to be from blastmail or RAKUS
Other cases this month where one delivery service exposed the recipients of many client organizations include unauthorized access to Ymirlink's Cuenote FC email delivery service and unauthorized access to the SpeeCAN RAIDEN disaster alert email service. In both, recipients checked whether they were affected through the notices of the organizations they receive email from. This time, in addition, the contact details and payment history of every customer organization were taken.
What organizations using blastmail should do
RAKUS Lite Cloud says it has contacted individually the customers whose recipient lists and similar data were confirmed leaked. The steps below are based on the company's guidance and that of the Personal Information Protection Commission.
Check whether you were contacted individually
RAKUS Lite Cloud says it has finished contacting all 344 contracts where a leak of data other than customer account data, such as recipient lists, was confirmed. Check whether a message arrived at the contact and billing addresses registered in your contract. The company says the number may change, so keep checking its updates even if nothing arrived. Contact the support center listed on the company's notice page.
List what you registered in your recipient lists
The data in scope depends on what you put in your recipient lists. The Niigata Nippo lists eight items including name (in katakana), gender and age band, while the GREEN×EXPO volunteer bulk email lists volunteer application number, activity number and email address and says names were not provided. Being able to say which items you did not hold keeps your explanation to recipients short.
Decide on reporting to the Personal Information Protection Commission and notifying individuals
Personal data in a recipient list is personal data managed by the organization that sends the email. According to the Personal Information Protection Commission, leaks that may have been carried out for a wrongful purpose (including suspected cases) and leaks involving more than 1,000 people (more than 100 for administrative organs and local government bodies) must be reported (Responding to leaks and helpful resources, Japanese).
RAKUS Lite Cloud offers a procedure for client organizations to report to the Commission jointly with the company (joint report guide, applications due October 29, 2026). According to the company, even with a joint report, client organizations whose recipient lists were confirmed leaked must notify the individuals themselves, and organizations holding the PrivacyMark must report to JIPDEC themselves. If you are unsure, consult the Commission's help desk or a professional such as a lawyer.
Warn your recipients
Most organizations that disclosed impact are asking people to watch for suspicious emails pretending to be from them and not to open the URLs. Post the warning in your official site's news, and if you send it by email, make it easy to tell apart from fakes: no links, and state the sender address.
Warn your own staff about fake billing and re-login emails
The contact names, phone numbers, email addresses, billing email addresses and payment history of every customer were taken. Tell your accounting and email staff that if they receive invoices, payment-detail changes or re-login instructions for the restart claiming to be from blastmail or RAKUS, they should check through the company's official notices or support center, not through links in the email (how to check senders: SPF, DKIM and DMARC basics).
This site's view: a delivery service's customers are both the sender and a leaked party
In email delivery service incidents, attention usually goes to recipients' addresses. This time, in addition, the contact details and payment history of every customer organization were taken. Client organizations have to explain the incident to their recipients, and at the same time their own staff may be targeted.
Check the contacts registered with the delivery service
Check whether the contact or billing email registered at sign-up is still the personal address of someone who has left. That shows up as missed individual notices or fake invoices nobody notices. Using a shared department address keeps contact going when staff change.
Review API keys and admin passwords following the company's guidance after the restart
According to the notices, the third party intruded into API servers and connected to the service database. They do not say whether API keys or admin console passwords leaked. When the service restarts, check the company's guidance, regenerate API keys if you can, and make sure the admin password is not reused on other services (key-handling basics: .env and API key basics).
Decide how to reach people when delivery stops
Delivery has been stopped since October 21 and no restart date has been set. The Niigata Nippo and the GREEN×EXPO association have moved their communications during the stoppage to their official websites. Decide in advance what you will use when delivery stops (for managing providers, see also When your hosting provider is breached).
Sources (public record)
The facts in this article are based on the public information below. The undisclosed intrusion route is not speculated on.
- RAKUS Co., Ltd., "[First report] Detection of suspicious access to blastmail, provided by our subsidiary, and service suspension" (October 21, 2026, Japanese) — rakus.co.jp
- RAKUS Co., Ltd., "[Second report] Data leak due to unauthorized access to blastmail, provided by our subsidiary, and service suspension" (October 21, 2026, Japanese) — rakus.co.jp
- RAKUS Lite Cloud Co., Ltd., "[Important] Apology and report on the emergency suspension of blastmail and the personal data leak (updated 13:20, October 24, 2026)" (Japanese) — info.blastmail.jp
- RAKUS Lite Cloud Co., Ltd., "Temporary suspension of the blastmail website" (Japanese) — info.blastmail.jp
- RAKUS Lite Cloud Co., Ltd., "Guide to joint reporting to the Personal Information Protection Commission" (October 23, 2026, Japanese) — info.blastmail.jp
- RAKUS Co., Ltd., notices of the temporary suspension (October 21) and restart (October 22) of seven services (Japanese) — suspension / restart
- The Niigata Nippo, notices on the leak of member data due to unauthorized access at RAKUS Lite Cloud (second notice October 22, third October 23, fifth October 24, Japanese) — second / third / fifth
- Shikoku Railway Company (JR Shikoku), "Possible leak of personal data due to unauthorized access at RAKUS Lite Cloud" (October 22, 2026, Japanese) — jr-shikoku.co.jp
- City of Yokohama press releases on possible leaks in the GREEN×EXPO volunteer applicant emails, the Yokohama Women's Association for Communication and Networking newsletters and the Shirahata District Center newsletter (all October 22, 2026, Japanese) — GREEN×EXPO / gender equality association / Shirahata District Center
- Ministry of the Environment, "Possible leak of recipient data for newsletters involving the Ministry of the Environment" (October 23, 2026, Japanese) — env.go.jp
- giftee, Inc., "[Follow-up] Possible leak of personal data due to unauthorized access at RAKUS Lite Cloud" (published October 22, updated October 23, 2026, Japanese) — giftee.co.jp
- Personal Information Protection Commission, "Responding to leaks and helpful resources" (Japanese) — ppc.go.jp
Update history
2026-10-24: First version, based on RAKUS's first and second reports of October 21, RAKUS Lite Cloud's notice updated at 13:20 on October 24 and its joint report guide, and client organizations' notices. Will be updated when the intrusion route, the affected client organizations or the service restart are disclosed.
Read next
- Similar incidents: Unauthorized access to Ymirlink's Cuenote FC / Unauthorized access to SpeeCAN RAIDEN
- Spotting fake emails: What is phishing? / When spam arrives from your own address
- Checking senders (for site operators): SPF, DKIM and DMARC basics
- Other 2026 incidents: List of data breaches and cyberattacks