For: people who received the newsletter of Piccoma, a Japanese manga app, and anyone who sends email through an outside delivery service. This article is based on the official announcement of Kakao piccoma Corp. and the delivery service's own notice, and does not cover attack or scam techniques.
Developing: this article will be updated as the organisation publishes more
As of the morning of October 26, 2026Not yet known
- How and when affected customers are contacted individually
- Which newsletter send was affected
- Whether the count changes (it is the number reported so far by the delivery service)
- How the delivery service was breached
In its October 24 notice (first report), the company said it will promptly post any new facts on the same page. When this site checked Piccoma's notice list on the morning of October 26, no follow-up had been published. The delivery service said in its October 25 10:00 update that it had no new confirmed information, and scheduled its next report for around 10:00 on October 26 (Japan time).
What newsletter recipients should do today
Do not open links in emails or texts claiming to be from Piccoma or publishers
The company asks users to watch out for suspicious emails and texts impersonating Piccoma or publishers, and not to open links in unexpected messages or enter personal details or passwords.
Offers of free titles, coins or points, or requests to confirm your account look natural to app users, which makes fakes harder to spot. To check anything, use the Piccoma app or the Piccoma website opened yourself (see What is phishing?).
Never enter a password or card number from an email
The company says it never asks for passwords or credit card details by email. An email that takes you to a login or payment page should be treated as suspect for that reason alone.
If you get an individual notice, confirm it in the app
The company says it will contact affected customers individually, but does not say how (email, in-app notice or otherwise). Fake "apology" messages in the company's name are also possible in general. Before opening any link, check that the same information appears in the notices section of the app or website.
The company has not asked users to change passwords
According to the company, passwords were never given to blastmail and cannot have leaked, and accounts and purchase data were not affected. So the announcement gives no reason to rush to change your Piccoma password because of this incident. If you reuse the same password on other services, this is still a good moment to fix that.
What happened (from Kakao piccoma's announcement)
Kakao piccoma Corp. posted a notice titled "Notice and apology regarding the leak of customer email addresses due to unauthorized access to an email delivery system" (first report, in Japanese) on Piccoma on October 24, 2026. Everything below is from that notice. What happened at the upstream delivery service is covered in unauthorized access to the blastmail email delivery service.
October 21, 2026 (Wed), around 0:30
The company running blastmail detects suspicious access and stops all its services.October 24 (Sat)
The delivery service reports to Piccoma that recipient email addresses of its newsletter leaked.October 24
Piccoma announces it in its notices (first report), stops its newsletter and reports to the Personal Information Protection Commission.
Piccoma app, website and company systems
Accounts, passwords, purchase data
Not accessed, not affected (company)
Email delivery service (blastmail)
Newsletter recipient email addresses (one send, 1,002,404 records)
Leaked through unauthorized access by a third party
↓ What can happen (in general)
Fake emails and texts in the name of Piccoma or publishers
Do not open the links; check in the app
- Who
- Customers who were recipients of one Piccoma newsletter send (1,002,404 records). The figure is what the delivery service has reported so far
- Items leaked
- Email address (registered to receive the newsletter)
- Not included
- Customer management numbers, last-purchase dates and similar data (confirmed not included). Passwords were never given to blastmail and cannot have leaked
- Not held at all
- Names and credit card details (the company does not hold them)
- Piccoma itself
- The app, website and company systems were not accessed. Accounts, passwords and purchase data were not affected; the service works as normal
- Piccoma Novels
- No leak confirmed so far for its newsletter
- Company response
- Newsletter stopped. Settings changed so that email sent from blastmail is not treated as genuine Piccoma email. Reported to the Personal Information Protection Commission. Working with the delivery service to confirm details and affected customers
- Contact
- The inquiry form under "Help" in the Piccoma app or website
What is known and what is not
Based on the company's October 24 notice and the delivery service's October 25 10:00 update, as of the morning of October 26. The status column will be updated as follow-ups appear.
| Item | What was announced | Status |
|---|---|---|
| Email address | Registered to receive the newsletter | Leak confirmed (company) |
| Count | 1,002,404 records (recipients of one newsletter send); the number reported so far by the delivery service | Company figure; may change |
| Management numbers, last-purchase dates, etc. | Confirmed not included | Not included (company) |
| Passwords | Never given to blastmail; cannot have leaked | Not included (company) |
| Names, credit card details | Not held by the company | Not included (company) |
| Accounts, purchase data | Not affected | Not included (company) |
| Piccoma app, website and company systems | Not accessed | No access (company) |
| Piccoma Novels newsletter | No leak confirmed so far | Not confirmed (company) |
| Which send | Not stated | Not stated |
| Individual notices | The company says it will contact customers; method and timing not stated | Method and timing not disclosed |
| How the delivery service was breached | Under investigation, according to the delivery service | Under investigation |
| Misuse such as fake emails | Not stated | Not stated |
Records, not people
The company gives 1,002,404 as a number of records. Since one person may register more than one address, it is not necessarily the number of people. This article uses "records" as well.
What can happen when only email addresses leak
In general, when an email address becomes known together with the service it is used for, the following can happen (the company has not reported any of this in this incident).
What can happen in general
- Fake campaigns or "confirm your account" emails in Piccoma's name
- Emails using a publisher's or title's name to lead you to a login or card entry page
- Fake "apology" emails asking for personal details to receive compensation
What you can do
- Check the content in the Piccoma app
- Do not log in from a link in an email
- Never enter a password or card number from an email
Names were not included, so this leak alone cannot be used to write emails that address you by your real name. But your name may be known from other sources, so a correct name is not proof that an email is genuine. Preparing for fake emails after an address leak is also covered in the JR East, VIEW Card and JR Kyushu possible email leak.
For anyone who sends email through an outside delivery service
How the delivery service was breached is still under investigation. This section only covers what follows from Piccoma's announcement. The delivery service's response and how client organizations decide on reporting and notifying are covered in the blastmail article.
Give the delivery service only what it needs to send
According to the company, only email addresses leaked, and customer management numbers and last-purchase dates were not included. If your mailing lists contain only what sending needs, and not member numbers, purchase history or names, a breach at the delivery service exposes nothing more. Write down which columns your mailing lists actually contain and check them once.
Stop a breached delivery service from sending in your name
The company says it changed settings so that email sent from blastmail is not treated as genuine Piccoma email (the specific settings are not described). In general, allowing a delivery service to send from your domain is set up with SPF, DKIM and DMARC (mechanisms that let receivers check whether a sender is genuine). Decide in advance how, and by whom, that permission is removed if the service is breached (basics in SPF, DKIM and DMARC basics).
Have another way to reach users when delivery stops
The company announced the incident in its notices and directs inquiries to the help section of the app and website. Even with the newsletter stopped, it can reach users through its own channel, such as in-app notices. Check that you have a way to reach users other than email.
Sources (public records)
The facts in this article are based on the public information below. How the service was breached and the cause, which have not been disclosed, are not guessed at.
- Kakao piccoma Corp., "Notice and apology regarding the leak of customer email addresses due to unauthorized access to RAKUS Lite Cloud's email delivery system blastmail (first report)" (October 24, 2026, Japanese, checked October 26) — piccoma.com
- RAKUS Lite Cloud Corporation, "[Important] Apology and report on the emergency suspension of blastmail and the personal data leak" (updated October 25, 2026, 10:00, Japanese) — info.blastmail.jp
Update history
2026-10-26: First version, based on Kakao piccoma's October 24 notice (first report) and the delivery service's October 25 10:00 update. Will be updated when follow-ups on individual notices or the count are published.
Read next
- The upstream delivery-service incident and other affected organizations: Unauthorized access to the blastmail email delivery service
- A similar incident: Unauthorized access to Ymirlink's Cuenote FC
- Spotting fake emails: What is phishing?
- Checking senders (for site operators): SPF, DKIM and DMARC basics
- Other 2026 incidents: List of data breaches and cyberattacks