Security Guides

#data breach #phishing #smishing #incident response #Japan

Yamato Transport and Sagawa Express breaches (count under investigation): addresses and purchases may have leaked — what parcel recipients should do

Sagawa Express (parcel tracking) and Yamato Transport (Kuroneko deferred payment) say names, addresses and billing details may have leaked. Who is affected and how to spot fake delivery texts.

Published 2026-10-03 Updated 2026-10-03 Last verified 2026-10-03 13 min read

For: anyone in Japan who sent or received a parcel by Sagawa Express since early summer 2026, Sagawa Smart Club members, anyone who has paid for online orders with Kuroneko deferred payment (Kuroneko Daikin Atobarai), and shops that offer it. This article is based on the companies' official notices and does not cover attack techniques.

Bottom line

Do not open links in messages claiming to be a carrier or deferred-payment service; check in the official app yourself

These are separate incidents, but in both, what may have leaked is your real name, address and phone number, together with the fact that you sent or received a parcel or what you bought and for how much. That combination makes fake missed-delivery notices and payment demands look real.

Do not open links in texts or emails in either company's name (both say they do not send missed-delivery notices by SMS)
Check parcels in the official app, or on the official site you open yourself, by typing in the tracking number yourself
Check any deferred-payment bill against the order history at the shop you bought from
A message that has your correct name and address is not proof that it is genuine

Are you affected? A quick comparison

	Sagawa Express	Yamato Transport
Service	Parcel tracking service ("Onimotsu Toiawase") on its website	Kuroneko deferred-payment service for online shopping
Discovered	September 30, 2026	September 28, 2026 (service stopped at 22:28 that day)
Who may be affected	Senders and recipients of about 100 days of parcels, freight-contract customers, Smart Club members	Some users of the service, some participating shops, employees who handle it
Data that may have leaked	Name, address, phone number (plus email and member ID for Smart Club members)	Name, address, phone, email, credit-screening number, billing amount, outstanding balance, item details
Not included	Credit card information, passwords	Credit card information, passwords, etc.
Number affected	Under investigation	Under investigation
What is stopped	Nine web services, including online booking (pickup and delivery run normally)	The deferred-payment service (parcel delivery and other services run normally)

Sagawa's "about 100 days" counts back from September 30, so roughly late June onward. You do not need to have used Sagawa yourself: if an online order was delivered to you by Sagawa, you may be included as the recipient.

For Yamato, the people affected are those who chose Kuroneko deferred payment at checkout. If you are not sure, look at past order-confirmation emails or payment slips for the payment method.

What to do today

Do not open links in texts or emails claiming to be a delivery company

Yamato says it does not send missed-delivery or scheduled-delivery notices by SMS, and does not email or text requests for address confirmation or redelivery payments. Sagawa says it does not send SMS notices about pickup and delivery.

So a text saying "we took your parcel back because you were out" or "we could not deliver because of an unknown address" can be treated as fake even when it uses either company's name. Delete it without opening the link (how to spot these: What is phishing?).

Check parcels in the official app or a site you open yourself

If you want to know whether a parcel is really on its way, do not start from the message. Use the official app you already installed, or the official site opened from a bookmark or a search.

The tracking number is in the shipping email or order history from the shop you bought from. If you type it in yourself, you cannot end up on a fake site. Sagawa has stopped or restricted part of its online tracking; if it does not load, contact your nearest Sagawa branch.

Check deferred-payment bills and reminders against the shop's order history

Yamato's notice includes the billing amount, the outstanding balance (the amount not yet paid) and item details. Anyone who knows what you bought, for how much and what is still unpaid can write a very accurate "we have not received your payment" reminder.

If you get a reminder or an "unpaid" notice, do not use the number or link in it. Open the order history at the shop you bought from and check the payment method, amount and order date. Take anything you do not recognize, or that does not match, to that shop directly.

Do not assume a message is real because your name and address are correct

With this data, a fake message can include your real name, your correct address, roughly when you received a parcel, and even the name of the item you bought.

Correct personal details in a message are not proof that the sender is genuine. The same assumption was exploited in the Booking.com case, where real reservation details were used.

If you already opened a link and entered something

If you entered a card number, call your card issuer right away and have the card stopped. If you entered a password, change it on that service and on every other service where you used the same one (a password manager is the realistic way to stop reusing passwords).

If a fake site led you to install an app, remove it from your phone's settings and check for texts you did not send and for charges billed to your phone account (Smartphone security basics).

Use each company's official contact

Sagawa has opened a dedicated call center for the possible leak (0120-28-3449, 9:00 to 17:00 including weekends and holidays, Japan only). Questions about a parcel itself go to your nearest branch.

Yamato's notice lists an email contact (scmail2@kuronekoyamato.co.jp). The company says it will contact people whose data is confirmed leaked individually.

What happened (from the companies' notices)

Everything below is as stated in each company's official notices. Each notice covers only that company's service, and neither mentions the other incident.

Sep 28, 2026 (Mon)
Yamato Transport confirmed unauthorized access by a third party to its Kuroneko deferred-payment service, restricted outside access, and stopped the service at 22:28 that day.
Sep 29
Yamato published its first notice, saying parcel delivery and other services run normally.
Sep 30 (Wed)
Sagawa Express confirmed unauthorized access by a third party to the parcel tracking service on its website and partly restricted access (first notice).
Oct 1
Sagawa's second notice: personal data may have leaked, and nine web services were stopped. A third notice opened a dedicated call center.
Oct 2
Yamato's second notice: some data on users, participating shops and employees may have leaked.

~100 days

Sagawa: period of parcels that may be affected (back from Sep 30)

Unknown

Neither company has stated how many people are affected

Not included

Credit card data and passwords (both companies)

9 services

Sagawa web services stopped (pickup and delivery run normally)

Sagawa Express (second and third notices, October 1, 2026)

Service: The parcel tracking service ("Onimotsu Toiawase") on the company website
Parcel senders and recipients: Name (company name and contact person for businesses), address, phone number. Cumulative data for about 100 days back from September 30
Freight-contract customers: Name (company name and contact person for businesses), address and phone number of business and individual customers with freight-rate contracts
Smart Club users: Name (company name and contact person for businesses), address, phone number, email address, Smart Club member ID
Not included: Credit card information, passwords
Stopped services: Online parcel tracking; its API (the connection shops use to pull tracking data into their own systems); online booking for Hikyaku parcel delivery, round-trip delivery and golf round-trip delivery; a product return-and-refund service; two delivery-address change services (before delivery and after a missed delivery); and the "Kaishu-kun" collection service
Count and cause: Number, scope and cause under investigation
Contact: Dedicated call center 0120-28-3449 (9:00-17:00, including weekends and holidays)

Yamato Transport (second notice, October 2, 2026)

Operator: The service is run, and the notice issued, by Yamato Transport Co., Ltd. (published on the Yamato Holdings website)
How the service works: Shoppers receive goods ordered online first, then pay later, for example at a convenience store, using a payment slip or a notice sent to their smartphone
Some users: Name, address, phone number, email address, credit-screening number (a number tied to the deferred-payment approval check), billing amount, outstanding balance, item details
Some participating shops: Merchant name, merchant code
Employees: Names of employees who handle the service
Not included: Credit card information, password information, etc.
Next steps: Individual contact to people whose data is confirmed leaked. No date yet for restoring the service. Scope and cause under investigation
Contact: Email scmail2@kuronekoyamato.co.jp

How to read it: 'may have leaked' still means preparing now

Both companies say data "may have" leaked, and neither has confirmed numbers. Fake messages, however, do not wait for confirmation.

Texts impersonating delivery companies were already common in Japan before these incidents. Regardless of this case, the habit of not opening links and checking in the official app is worth keeping.

How this data changes fake messages

Until now, most fake missed-delivery texts in Japan were mass messages with no name. With this data, messages like these become possible.

Messages the leaked data makes possible

An "address confirmation" request with your real name and correct address
A missed-delivery notice timed to when you actually received a parcel
A "we could not confirm your payment" notice naming the item you bought and the amount
Phone calls to your number from someone claiming to be the carrier or the payment service

What you can still check

Both companies say they do not send missed-delivery notices by SMS
Your tracking number is in the shop's shipping email or order history
The correct amount and payment method are in the shop's order history
The official app, or a site you open yourself, keeps you off fake sites

This site's view: you cannot judge a deferred-payment bill by how it arrives

What Yamato says it does not send by SMS is missed-delivery and scheduled-delivery notices. The Kuroneko deferred-payment service, by Yamato's own description, works through a payment slip or a notice sent to your smartphone.

So "it came to my phone, so it is fake" does not hold for bills. What matters is the content: whether the amount, order date and payment method match the shop's order history. A demand to read out prepaid e-money card numbers, or to transfer money to an account in a private person's name, does not fit how deferred payment works, so do not pay it.

For shops that offer this service

Yamato's notice includes the merchant name and merchant code of some participating shops. Sagawa has also stopped the API that shops use to pull tracking data automatically.

Tell customers what your payment messages look like

Your customers may receive fake reminders or shipping notices using your shop's name. Use a site notice or your order-confirmation email to explain how your shop asks for payment (who sends it, by which channel, asking for what) and where to ask questions, so customers can tell real from fake.

Verify any 'change of procedure' request that uses your merchant code through another channel

With the merchant name and code, it becomes easier to impersonate the service provider and ask you to "change your settlement account" or "re-register". Verify such requests by calling a known contact listed in your contract documents (protecting your own domain: Email spoofing and SPF, DKIM, DMARC).

Tell customers that tracking updates are paused

While Sagawa's API is stopped, delivery status in your shop's account pages may not update. Saying so, and that the tracking number in your shipping email still works, means fewer customers turn to fake "check your delivery status here" messages.

For a comparison with other major Japanese breaches disclosed the same year, see Japan's major data breaches of 2026; for a case where identity-document images leaked as well, see the Times Car breach.

Sources (public record)

The facts in this article come from the public sources below. Undisclosed methods or causes of the intrusion are not speculated on.

Sagawa Express Co., Ltd., unauthorized access to the parcel tracking service (first notice, September 30, 2026, Japanese) — sagawa-exp.co.jp
Sagawa Express Co., Ltd., possible leak of personal data from unauthorized access to the parcel tracking service (second notice, October 1, 2026, Japanese) — sagawa-exp.co.jp
Sagawa Express Co., Ltd., third notice (October 1, 2026: dedicated call center, Japanese) — sagawa-exp.co.jp
Sagawa Express Co., Ltd., warning about spam impersonating Sagawa (states it does not send SMS about pickup and delivery, Japanese) — sagawa-exp.co.jp
Yamato Transport Co., Ltd., unauthorized access to the Kuroneko deferred-payment service (first notice, September 29, 2026, Japanese) — yamato-hd.co.jp (PDF)
Yamato Transport Co., Ltd., second notice on unauthorized access to the Kuroneko deferred-payment service (October 2, 2026, Japanese) — yamato-hd.co.jp
Yamato Transport, warning about spam impersonating Yamato (updated August 26, 2025; lists what it does not send by email or SMS, Japanese) — yamato-hd.co.jp

Update history

2026-10-03: First version, based on Sagawa Express's notices of September 30 (first) and October 1 (second and third), and Yamato Transport's notices of September 29 (first) and October 2 (second). Both companies say the number, scope and cause are under investigation; this article will be updated when they publish more.

FAQ

QWhat may have leaked in the Sagawa Express breach?

According to Sagawa Express's second notice of October 1, 2026, three groups are covered: (1) senders and recipients of parcels the company handled — name (company name and contact person for businesses), address and phone number, covering roughly the 100 days before September 30; (2) business and individual customers with freight-rate contracts — name, address and phone number; and (3) users registered with its Smart Club web service — name, address, phone number, email address and member ID. Credit card information and passwords are not included. The number of people and the scope are under investigation.

QWhat may have leaked in the Yamato Transport breach?

According to Yamato Transport's second notice of October 2, 2026, for some users of the Kuroneko deferred-payment service (Kuroneko Daikin Atobarai): name, address, phone number, email address, credit-screening number, billing amount, outstanding balance and item details. Also the merchant name and merchant code of some participating shops, and the names of employees who handle the service. Credit card information and passwords are not included. The scope is under investigation, and the company will contact people whose data is confirmed leaked.

QCan I be affected if I never used Sagawa Express?

Yes. Sagawa's notice covers both the senders and the recipients of parcels it handled. If something you ordered online was delivered by Sagawa, your name, address and phone number may be included as the recipient, even if you never registered with any Sagawa service. The period is about 100 days back from September 30 (roughly late June onward).

QAre the Yamato and Sagawa incidents connected?

Each company's notice covers only its own service, and neither mentions the other incident. The dates of discovery (September 28 for Yamato, September 30 for Sagawa) and the affected services also differ. This article treats them as separate incidents.

QDo Japanese delivery companies send missed-delivery texts?

Yamato Transport officially states that it does not send missed-delivery or scheduled-delivery notices by SMS, and does not email or text requests for address confirmation or for payment related to redelivery. Sagawa Express states that it does not send SMS notices about pickup and delivery. If you get a text in either company's name about a missed delivery or an unknown address, delete it without opening the link.

QHow can I tell whether a Kuroneko deferred-payment bill is real?

Do not use the link or phone number in the message. Open the order history at the shop where you bought the item and check that the payment method, amount and order date match. Yamato describes the service as paying later, for example at a convenience store, from a payment slip or a notice sent to your smartphone after you receive the goods. Take any bill you do not recognize, or one with a different amount or payment method, to the shop directly.

QShould I change my password?

Both companies say passwords are not among the data that may have leaked. Smart Club members' email addresses and member IDs are included, though, so if you reuse the same password elsewhere, this is a good moment to stop.

QWhat caused the breaches?

As of October 3, 2026, neither company has disclosed how the unauthorized access happened or its cause. Sagawa says it is still investigating the scope and cause; Yamato says it is investigating with the help of an outside security firm.