For: people who have ordered business cards, postcards, flyers or similar through Raksul, and people whose names or addresses appear on those printed items. This article is an explanation based on the official notice from Raksul Inc.; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who have ordered business cards, postcards, flyers or similar through Raksul, and people whose names or addresses appear on those printed items.
- Confirmed so farSee the table ↓
- Discovery
- System involved
- Illegitimate acquisition of credentials
Listed as possibly affected
- Name, company name, address, phone number, email address
- Information about people other than the orderer
- Not yet confirmed
- Count and scope
- Start of the affected period
- Details of the cause (how the credentials were obtained)
2 more
- Whether and how affected customers will be contacted
- When the services that remain stopped will restart
- What to do nowSee the steps ↓
- If you ordered, list your orders up to November 8, 2026
- Decide with your privacy contact whether the people you listed need an explanation
- Do not open links in messages using the Raksul name or a related business's name
2 more
- If your name is on someone else's order, do not act on a convincing message on the spot
- If you are worried, use the official contact point
- Where to verify (source)All sources ↓
- Raksul Inc., "Possible leak of personal information due to unauthorized access to our system" (November 9, 2026; Japanese)
- Last checked
- As of November 10, 2026
Follow-up plans and what we checked
The company says it will post follow-up information on its website as the investigation progresses. It plans to report to the Personal Information Protection Commission. When we checked the official site on November 10, 2026, we found no newer notice after that of November 9.
What customers and people named on printed items should do today
If you ordered, list your orders up to November 8, 2026
The affected period is "under investigation through November 8, 2026", with no start date yet. If you have ordered business cards, postcards, invoices or Web Yubin through Raksul, use your order history to list what print data you submitted (this site's view).
Check first the data containing the names, addresses and phone numbers of business contacts, customers or employees: business cards, addressed postcards, invoices and so on.
Decide with your privacy contact whether the people you listed need an explanation
The company says print data such as business cards and postcards may contain information about the people named on them. As the person who ordered, decide with your privacy contact or manager whether to tell the people you listed what messages they might receive because of this incident (this site's view).
Stay within what the notice says: what may have leaked, and that card information and similar items are not included. The count and scope are under investigation, so do not fill in what is not known.
Do not open links in messages using the Raksul name or a related business's name
The company asks customers to watch for suspicious emails, texts and calls pretending to be the company or related businesses. Do not open URLs in suspicious messages and do not enter credentials.
The company says it never asks customers by email or text to enter passwords or credit card numbers outside procedures the customer started. For how to spot fakes, see What is phishing?.
If your name is on someone else's order, do not act on a convincing message on the spot
When a name, company name, address, phone number and email address are all known, it becomes easier to write messages that impersonate a business contact or recipient, or invoice-style notices. This is what can generally happen, not a statement that it happened in this incident.
For a payment or contact-detail change request that arrives in a known person's name, call back on a number you already know, not the one in the message.
If you are worried, use the official contact point
The company's contact point is to send a message through the contact form (corp.raksul.com/contact) and select "Personal Information Protection Consultation Desk". It is open 24 hours, and replies come in turn on weekdays 10:00 to 18:00 Japan time. When inquiries are heavy, replies can take longer.
The company has confirmed that card information, login IDs and passwords did not leak. In this site's view there is no need to rush to change your password because of this incident alone, but if you entered one on a suspicious page, change it right away (Choosing a password manager).
What happened (from the Raksul notice)
Raksul Inc. announced this on November 9, 2026 as a press release on its corporate site. Everything below is from the company's notice.
Nov 8, about 00:20
Unauthorized access by a third party to the system involved in processing data submissions for Raksul came to light.Nov 8
The company disabled the credentials that were misused, suspended the account used for the access, and stopped some services involving data submission (the notice gives a date only for the stoppage).Nov 9, 07:00
Services that had been stopped began restoring in turn. Raksul Packaging, the Raksul Adobe Express integration, the design production request service and the catalog site remain stopped.Nov 9
The company issued the press release and said it plans to report to the Personal Information Protection Commission.
- Discovery
- About 00:20 on November 8, 2026
- System involved
- The system involved in processing data submissions for Raksul
- What is confirmed
- Unauthorized access by a third party. Credentials for the company's system were obtained illegitimately, leaving part of the stored data reachable from outside
- Information that may have leaked
- Names, company names, addresses, phone numbers, email addresses and similar details in print data submitted to the service and in data such as invoices and Web Yubin. Information about people named on printed items such as business cards and postcards may be included
- Count and period
- Count being tallied. Period: under investigation through November 8, 2026
- Not included
- Credit card information, login IDs, passwords (confirmed not to have leaked)
- Secondary harm
- None confirmed
- Impact on services
- Some services involving data submission stopped from November 8; restored in turn from 07:00 on November 9. Data checks and shipping may take longer than usual
- Contact
- Contact form, select "Personal Information Protection Consultation Desk" (open 24 hours; replies in turn on weekdays 10:00 to 18:00)
What is known and what is not
Based on the company's notice of November 9, as of November 10, 2026. When there is news, we will rewrite the Status column.
| Item | What the notice says | Status |
|---|---|---|
| Discovery | About 00:20 on November 8, 2026 | Confirmed (company) |
| System involved | The system involved in processing data submissions | Confirmed (company) |
| Illegitimate acquisition of credentials | Credentials for the company's system were obtained illegitimately, leaving part of the stored data reachable from outside | Confirmed (company) |
| Name, company name, address, phone number, email address | Information in print data, invoices, Web Yubin and similar data; may have leaked | Possible (company) |
| Information about people other than the orderer | Information about people named on business cards, postcards and similar items may be included | Possible (company) |
| Other items | "And similar" is used; whether other items are included is not stated | Not stated |
| Count | Being tallied | Under investigation |
| Affected period | Under investigation through November 8, 2026 | Under investigation |
| Credit card information, login IDs, passwords | Confirmed not to have leaked | Not included (company) |
| Secondary harm | No misuse of related personal information confirmed | Not confirmed (company) |
| How the credentials were obtained | Not stated | Not stated |
| Individual notice to affected customers | Not stated | Not stated |
| Report to the Personal Information Protection Commission | The company plans to report | Under investigation |
| Service restoration | Some services restored from 07:00 on November 9; four remain stopped | Under investigation |
What names, company names, addresses and phone numbers can be used for
These are things that can generally happen from the combination of items; they do not mean they happened in this incident.
| Combination | What can generally happen | What to do today |
|---|---|---|
| Name + company name + address | An addressed invoice or payment request that impersonates a supplier or client | Confirm payment-detail changes by calling a number you already know |
| Name + phone number | A call or text using a company or print shop name | Hang up and call back through the official site |
| Name + email address | A genuine-looking notice about "shipping delay" or "resubmitting data" | Do not open links; open your order history on the official site yourself |
What the information that may have leaked can enable
- Genuine-looking payment requests in the name of a business contact or recipient
- Fake sites reached through the excuse of a delivery delay
- Calls to people named on printed items that address them by name
What this notice's scope does not allow
- Card fraud (card information did not leak)
- Login to a Raksul account (login IDs and passwords did not leak)
What operators should review: whose details you put in files you hand to a print shop
The cause has not been disclosed in detail, so this covers only what the disclosed facts support.
- People you listed become your issue too: print data for business cards and postcards contains names, addresses and phone numbers of people other than the orderer. If the print shop has an incident, the orderer may be asked to explain to those people. When you submit a customer list for address printing, limit it to what printing needs (name and address) and remove unneeded items such as phone numbers and email addresses before handing it over, so less leaks.
- The dates from discovery to restoration were published: the company learned of the access at about 00:20 on November 8, disabled the credentials, suspended the account and some services, and began restoring services in turn from 07:00 on November 9. If your own submission or ordering system is protected by credentials, deciding in advance how to disable them and who does it shortens the time from discovery to stopping (a general point, not a statement about this incident's cause).
Sources (public record)
The facts in this article come from the public information below. We have not speculated about causes that have not been disclosed.
- Raksul Inc., "Possible leak of personal information due to unauthorized access to our system" (November 9, 2026; Japanese) — corp.raksul.com
Update history
2026-11-10: First version, based on Raksul Inc.'s notice of November 9. We checked the company's official site the same day and found no notice newer than November 9.
Read next
- Another e-commerce incident: ShopServe (E-Store) data breach
- Spotting fake emails: What is phishing? / Smartphone security basics
- Passwords: Choosing a password manager
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)