Security Guides
Unauthorized Access to Ymirlink's Cuenote FC Email Delivery Service (About 9 Million Cumulative Records): What Was Taken, and What Newsletter Recipients and Client Companies Should Do
Ymirlink said on October 19, 2026 that five Cuenote FC systems were breached and estimates that about 9 million cumulative records including email addresses were exported. Client notices and what to do.
Who this is for: people who receive newsletters or notification emails from companies and organizations, and companies and organizations that use Ymirlink, Inc.'s email delivery service Cuenote FC. This article is based on the official notices of Ymirlink and of the client organizations that disclosed impact. It does not cover how the attack was carried out.
Developing: this article will be updated as the organisation publishes more
As of October 23, 2026Not yet known
- Which items were exported
- How many people (the breakdown of about 9 million cumulative records)
- Which client companies the five systems belong to
- Which program and what vulnerability
- Whether any secondary harm (misuse of data) has occurred
Ymirlink, Inc. says it is investigating in detail with outside experts and will report again when new facts are found. It says the impact on results for the fiscal year ending December 2026 is "under review" and that it will disclose promptly if anything requires disclosure. As of October 23, no second report has been published.
What newsletter recipients should do today
Do not open links in emails claiming to come from the sender
Cuenote FC is a system companies and organizations use to send newsletters and notices. Recipients register their email address with the sending company or organization, not with Ymirlink. So if the data is misused, the likely form is fake emails using the sending company's name.
Even for emails such as "Please confirm your usage", "Please confirm your customer details" or "Your points are expiring", do not open links, attachments or QR codes in the message. To check, open the official app or an official site you have bookmarked (how to spot fakes: What is phishing?).
Check the notices of the companies whose newsletters you receive
Open the notices of the companies you receive newsletters from in the "Client organizations that disclosed impact" table below. For companies not in the table, check the news section of their official site. Dai Nippon Printing says it will contact people individually once they are found to be affected.
Do not enter a password or card number when asked
Ymirlink, Inc.'s notice does not mention passwords or credit cards. Dai Nippon Printing says passwords, credit card details and purchase history are not held in the email delivery system. Even so, someone who knows your name and email address can write an email asking you to enter them. If an email asks for them, check on the official site, not from the email.
Unsubscribe from newsletters you do not read, through the official site
The more newsletters you are signed up for, the harder it is to notice a fake among them. Unsubscribing from newsletters you do not read, by logging in on each company's official site rather than using the link in the email, makes it easier to notice an email that should not be arriving.
Also watch for spam showing @cuenote.jp as the sender
On October 20, Ymirlink, Inc. warned that several spam emails showing its domain as the sender and claiming to come from third parties had been seen. As examples it lists emails claiming to come from a credit card company, with subjects meaning "Please confirm your usage" and "Request to confirm usage details", sent from info@cuenote.jp. The company says it never instructs such emails to be sent. Its notice does not say whether this spam is related to the unauthorized access. It asks recipients to delete such emails without replying, clicking URLs or scanning QR codes, and to contact the police if they have started an exchange.
Client organizations that disclosed impact
Companies and organizations that use Cuenote FC have published their own notices. The table lists those this site checked by opening each organization's official page, and only notices that name Ymirlink or Cuenote FC (as of October 23, 2026).
Each status follows the organization's own wording. Ymirlink, Inc. has not said which clients the five affected systems belong to, so an organization in this table is not necessarily one of the five.
| Organization | What it used the service for (as stated) | Data that may be affected (as stated) | Status | Date |
|---|---|---|---|---|
| Dai Nippon Printing (honto) | Newsletter of the honto bookstore (people who accepted it) | Names, email addresses, internal system IDs. Passwords, credit card details and purchase history are not held in the email delivery system. Count under investigation | Possible (company) | October 21 |
| Saitama Prefecture | Newsletter of the prefecture's smart-agriculture site "Plat Saitama" (used by the contractor that runs the site) | 669 parties. For organizations: organization name, contact name, email address, industry; for individuals: name, email address, industry | Possible (prefecture) | October 20 |
| Kakuyasu | Newsletter for its business clients (restaurants) | Restaurant name, company name, name, email address. It has not confirmed that its data is in scope | Possible (company) | October 20 |
| NTTPC Communications | Email delivery for its services | Contact email addresses and other data of service users. No impact confirmed, but it cannot be fully ruled out | Possible (company) | October 20 |
| Katabami | Its email delivery | Not stated (it cannot rule out that data registered in the service was affected) | Possible (company) | October 20 |
| The Sanyo Shimbun | Six email services of its "Sandeji" news site, including breaking news, weather and train delay alerts | Not stated. Ymirlink told it no leak had been confirmed in the environment it uses | Not confirmed (company) | October 19–21 (reports 2–4) |
'Possible' in the table does not mean the organization has been confirmed as affected
Kakuyasu says it has not confirmed any information that its clients' data is in scope, but is acting with protection of that data as its priority; NTTPC Communications says it has not confirmed any impact but published its notice to alert customers. Dai Nippon Printing says Ymirlink reported that honto customer data may have leaked. At the Sanyo Shimbun, email delivery stopped from about 14:15 on October 18 because of a fault in the delivery system, and its fourth report on October 21 announced that it had been restored. Check whether a company whose newsletter you receive is in the table, then watch for that company's follow-up.
What happened (from Ymirlink, Inc.'s notices)
The following is based on Ymirlink, Inc.'s October 19, 2026 notice (the version updated with additional explanation at 19:05 that day on the Cuenote site) and its timely disclosure filed the same day. The timely disclosure document says only "email delivery service". The updated version on the Cuenote site added that the affected systems are "a total of five systems on the Cuenote FC dedicated ASP plan".
Early hours of Friday, October 16, 2026
A company staff member confirmed unauthorized access on some systems. The servers where unauthorized access was found were immediately disconnected from the network.After detection (date not stated)
Access logs showed that a program vulnerability was used to obtain the credentials of the company's support and quality-control staff, that a malicious program was installed and data exported from the database, and that those credentials were used to try to authenticate to other systems. The company created and applied a fix for the vulnerability and deleted the support and quality-control staff's information from other systems.October 19
Notice (first report) and timely disclosure. At 19:05 the notice was updated to name the affected systems (five systems on the Cuenote FC dedicated ASP plan). Client organizations began publishing their own notices from that day.October 20
Warning published about spam showing the company's domain as the sender (no stated link to the unauthorized access).
Email recipients
Registered their email address with the sending company (sometimes also a name or membership number)
To do: do not open links in emails claiming to be from the sender
Sending companies and organizations (clients)
Manage the mailing list and register it in Cuenote FC to send emails; they are responsible for the personal data
To do: confirm whether affected, decide on reporting and notification
Ymirlink (Cuenote FC)
About 9 million cumulative records including email addresses exported from five dedicated ASP plan systems (company estimate)
Affected clients and items under investigation
- Service
- Five systems in total on the dedicated ASP plan of the Cuenote FC email delivery service
- Confirmed
- Personal information was taken out through unauthorized access from outside. Unauthorized access to, and data export from, five systems
- Count
- A cumulative total of about 9 million records including email addresses estimated to have been exported from the five systems
- Items
- "Information including email addresses". Details under investigation
- Stated cause
- A program vulnerability was used to obtain the service credentials of the company's support and quality-control staff. Details of the vulnerability have not been disclosed
- Response
- Disconnected the servers, fixed the vulnerable program, deleted the staff credentials, set up detection for malicious programs, reported to law enforcement
- Next steps
- Detailed investigation with outside experts; will report when new facts are found. Impact on results for the fiscal year ending December 2026 is under review
- Contact
- A dedicated contact for the unauthorized access (phone 03-6820-0088, weekdays 9:00–20:00; an email contact is listed on the notice page)
According to the Cuenote FC product page, the dedicated ASP plan provides "dedicated resources", and is separate from the Premium plan, which runs in a shared environment, and the on-premises plan, which is installed in the customer's own environment. The notice names five systems on the dedicated ASP plan as affected and does not mention the other plans.
What is known and what is not
Status as of October 23, 2026. When follow-ups appear, this table's status column will be updated.
| Item | What the notice says | Status |
|---|---|---|
| Personal information taken out | Confirmed that personal information was taken out through unauthorized access from outside | Leak confirmed (company) |
| Affected systems | Five systems in total on the Cuenote FC dedicated ASP plan | Confirmed (company) |
| Count | A cumulative total of about 9 million records including email addresses estimated to have been exported. Not a count of people | Possible (company; estimate) |
| Items exported | "Information including email addresses". Details under investigation | Under investigation |
| Passwords and credit cards | Not mentioned in Ymirlink's notice (Dai Nippon Printing says they are not held in the email delivery system) | Not stated |
| Which clients the five systems belong to | Not disclosed | Under investigation |
| Impact on other plans (Premium, on-premises) | Not mentioned in the notice | Not stated |
| Cause | Staff credentials obtained through a program vulnerability. Details of the vulnerability not stated | Under investigation |
| Secondary harm (misuse of data) | Not mentioned in Ymirlink's notice. Dai Nippon Printing and Saitama Prefecture say no misuse has been confirmed so far | Not confirmed (Dai Nippon Printing, Saitama Prefecture) |
| Report to law enforcement | Filed | Confirmed (company) |
| Impact on business results | Under review | Under investigation |
Client counts cannot be compared with the 9 million figure
The figure of about 9 million is Ymirlink, Inc.'s estimate for all five systems together. Saitama Prefecture's 669 are parties (organizations and individuals) whose data it obtained through its site. They are counted differently, so they cannot be added or subtracted.
What email addresses and related data can be used for
In general, when the following data comes together, the following kinds of misuse can happen. This does not mean they happened in this case.
- Email address plus the sender's company name: fake emails claiming to come from that company reach the same address as the real newsletter, and recipients easily assume it is "the company that always sends me newsletters"
- Name plus email address: fake emails can include the recipient's real name, which makes them more convincing than mass spam
- Organization name, contact name and industry (for newsletters aimed at business clients): material for fake invoices or emails asking to change payment details, posing as a business partner
- Internal system ID: can be presented as a membership number ("Dear customer, member number ...") to look genuine
Another case where one delivery service exposed the addresses of many organizations' recipients is the October 2026 unauthorized access to the SpeeCAN RAIDEN disaster-alert service. There too, people found out whether they were affected through the notice of the organization that sent them the emails.
What companies and organizations using Cuenote FC should do
Ymirlink, Inc.'s public notice does not include specific requests to client companies. According to client notices, Ymirlink has been reporting to clients individually (NTTPC Communications and Dai Nippon Printing say they received a report on October 19, and the Sanyo Shimbun says it was told no leak had been confirmed in its environment). The steps below follow what client organizations are already doing and the guidance of the Personal Information Protection Commission (PPC).
Confirm with Ymirlink whether your environment is one of the five systems
Ymirlink, Inc. has set up a dedicated contact for the unauthorized access (phone 03-6820-0088, weekdays 9:00–20:00; the email contact is on its notice page). Check whether you use the dedicated ASP plan and whether you have received an individual report; if not, contact them.
List what you registered in the delivery system
What may be affected depends on what you registered in the delivery system. Check whether it was email addresses only, or also names, membership numbers and attributes (industry, region and so on). Dai Nippon Printing states that passwords, credit card details and purchase history are not held in the email delivery system. Being able to say what you do not hold keeps your explanation to recipients short.
Warn your recipients
Many of the organizations that may be affected ask people to watch for suspicious emails claiming to come from them and not to open the URLs. Saitama Prefecture sent an apology and warning by email to the 669 parties who may be affected, and Kakuyasu is warning its restaurant clients in turn. Make the warning easy to tell apart from a fake: do not put links in the warning email itself, and state the sender address you use.
Decide whether you must report to the PPC and notify individuals
Personal data in a mailing list is personal data managed by the company that sends the emails (the outsourcing party). According to the PPC's guidance, a leak (or possible leak) that may have been carried out for an unlawful purpose, or one involving more than 1,000 people (more than 100 for administrative organs, including local-government bodies), must be reported. Report promptly once it comes to light, and where an unlawful purpose is suspected, file the report within 60 days of discovery. The PPC also publishes a sample report for incidents at an outsourced contractor (Responding to leaks and useful materials, in Japanese).
This is general guidance; whether it applies to your company depends on what Ymirlink reports to you. If unsure, consult the PPC's help line or a lawyer or other specialist.
Decide whether to pause delivery, and announce when you resume
Dai Nippon Printing has cut the link between the honto system and the email delivery system to prevent further damage. If you pause, announce on your official site that delivery is paused and when it resumes, so recipients can tell that emails arriving during the pause are fake.
This site's view: the fewer items in the delivery system, the shorter the explanation
Lining up the client notices shows a wide range in the data that may be affected. Dai Nippon Printing kept only names, email addresses and IDs in the delivery system, and could say it holds no passwords, card details or purchase history there. Newsletters for business clients or registered members, by contrast, also stored organization names, contact names and industry.
To send emails, a delivery system needs the address and the minimum fields used for personalization. Even when purchase history or member attributes are used to target sends, it is worth considering whether they can be passed only when needed, for that send.
List the fields registered in the delivery system
Check whether, besides the address, you store names, membership numbers, attributes or purchase-related data. Stop registering fields you do not use for personalization or targeting.
Check what the delivery provider's support staff can access
In this case, the credentials of the delivery provider's support and quality-control staff were obtained and used to try to authenticate to other systems. For the services you use, check in the contract or admin console whether the provider's staff have access to your environment, and whether you can see logs of their actions yourself.
Decide in advance who receives vendor incident reports
Here, client organizations published notices after receiving reports from the delivery provider. Decide in advance who receives such a report and who decides on reporting to the PPC and notifying individuals (for how to think about vendor incidents, see also When your web hosting provider is breached).
Sources (public record)
The facts in this article are based on the public information below. We have not speculated about undisclosed attack methods. Titles are translated from Japanese.
- Ymirlink, Inc., "Report on unauthorized access to our systems (first report, updated version of October 19, 2026, 19:05)" (October 19, 2026) — cuenote.jp
- Ymirlink, Inc., "Report on unauthorized access to our systems (first report)" (October 19, 2026, timely disclosure) — ssl4.eir-parts.net
- Ymirlink, Inc., "Warning: beware of spam using our domain and impersonating third parties" (October 20, 2026) — ymir.co.jp
- Ymirlink, Inc., Cuenote FC product page (plan differences, checked October 23) — cuenote.jp
- Dai Nippon Printing Co., Ltd., "Possible leak of honto customer information due to unauthorized access at an outsourced contractor" (October 21, 2026) — dnp.co.jp
- Saitama Prefecture, "Possible leak of personal information due to unauthorized access at Ymirlink, Inc." (October 20, 2026) — pref.saitama.lg.jp
- Kakuyasu Co., Ltd., "Unauthorized access to the email delivery service we use, and our response" (October 20, 2026) — kakuyasu.co.jp
- NTTPC Communications, "Possible leak of email addresses and other data due to unauthorized access at Ymirlink, Inc." (October 20, 2026) — nttpc.co.jp
- Katabami Co., Ltd., "Unauthorized access to the email delivery service we use" (October 20, 2026) — katabami.co.jp
- The Sanyo Shimbun, "Temporary suspension of email delivery" (October 18, 2026), "Suspension of email delivery (second report) and unauthorized access at our contractor" (October 19), "(third report)" (October 20), "Email delivery resumed and unauthorized access at our contractor (fourth report)" (October 21) — suspension (October 18) / report 2 / report 3 / report 4
- Personal Information Protection Commission, "Responding to leaks and useful materials" — ppc.go.jp
- Press coverage (listing market and earnings outlook): ITmedia NEWS (October 20, 2026) — itmedia.co.jp
Update history
2026-10-23: First version, based on Ymirlink, Inc.'s October 19 notice (the 19:05 updated version) and timely disclosure, its October 20 warning, and notices from six client organizations. This article will be updated when the exported items, the affected clients and the results of the cause investigation are published.
Read next
- Similar cases: Unauthorized access to the SpeeCAN RAIDEN disaster-alert service / JR East, View Card and JR Kyushu email address leak / Unauthorized access to the Studio website builder
- Spotting fake emails: What is phishing? / Spam from your own email address
- Checking senders (for operators): SPF, DKIM and DMARC basics
- Other 2026 incidents: Data breaches and cyberattacks of 2026 (Japan and worldwide)
FAQ
QWhat leaked in the Ymirlink incident?
According to Ymirlink, Inc.'s October 19, 2026 notice, five systems on the dedicated ASP plan of its Cuenote FC email delivery service were accessed without authorization, and the company estimates that a cumulative total of about 9 million records including email addresses were exported. It has confirmed that personal information was taken out. Which items were included is under investigation. In client notices, Dai Nippon Printing lists names, email addresses and internal system IDs for honto; Saitama Prefecture lists organization names, contact names, names, email addresses and industry; and Kakuyasu lists restaurant names, company names, names and email addresses as data that may be affected.
QDoes 'about 9 million cumulative records' mean 9 million people?
Not necessarily. Ymirlink, Inc. says it 'estimates' that a cumulative total of about 9 million records were exported. In general, a cumulative count counts the same email address more than once if it appears in several mailing lists or several systems. It is neither a count of people nor a confirmed number. How many people, and which clients' users, has not been disclosed.
QHow can I tell whether I am affected?
Cuenote FC is a service companies and organizations use to send newsletters and notices. Recipients cannot easily tell which senders use Cuenote FC, and Ymirlink, Inc. has not named the affected clients. The table in this article lists the client organizations that disclosed impact and that this site checked on their official pages. If a company you receive newsletters from is not in the table, check its news page. Dai Nippon Printing says it will contact people individually once they are found to be affected.
QWere passwords or credit card details leaked?
Ymirlink, Inc.'s notice does not mention passwords or credit cards. Details of the exported data are under investigation. Among client companies, Dai Nippon Printing says passwords, credit card details and purchase history are not held in the email delivery system. No other client lists passwords or cards as affected data. The more likely risk is fake emails from someone who knows your email address and name, asking you to enter a password or card number.
QWhat caused it?
Ymirlink, Inc. says its access logs showed that a program vulnerability was used to obtain the credentials of its support and quality-control staff, and that a malicious program was installed and data exported from the database. Those credentials were also used to try to authenticate to other systems. It has not said which program or what kind of vulnerability. It is investigating in detail with outside experts and will report again when new facts are found.
QWhat should I do if I get an email claiming to be from a newsletter sender?
Do not open its links or attachments; check through the official app or an official site you have bookmarked. Dai Nippon Printing, the Sanyo Shimbun, NTTPC Communications and Kakuyasu ask people to watch for suspicious or unexpected emails claiming to be from them and not to open the URLs. On October 20, Ymirlink, Inc. also warned of spam that shows its domain (@cuenote.jp) as the sender and claims to come from a credit card company. Its notice does not say whether that spam is related to the unauthorized access.