2026-10-23
Unauthorized Access to Ymirlink's Cuenote FC Email Delivery Service (About 9 Million Cumulative Records): What Was Taken, and What Newsletter Recipients and Client Companies Should Do
On October 19, 2026, Ymirlink, Inc. (TSE Growth, 4372) announced that some server systems of its email delivery service Cuenote FC had been accessed from outside without authorization and that it had confirmed personal information was taken out. The affected systems are five systems on the dedicated ASP plan, and the company estimates that a cumulative total of about 9 million records including email addresses were exported. Details of the exported data are under investigation. The company confirmed the unauthorized access in the early hours of October 16. Its access logs showed that a program vulnerability was used to obtain the service credentials of its support and quality-control staff, that a malicious program was installed and data was exported from the database, and that those credentials were used to try to authenticate to other systems. It disconnected the servers, fixed the vulnerability, deleted the staff credentials, set up detection for malicious programs and reported the case to law enforcement. The impact on results for the fiscal year ending December 2026 is under review. Client organizations have also published notices: Dai Nippon Printing said the names and email addresses of people who accepted the honto newsletter may have leaked, Saitama Prefecture named 669 parties, and Kakuyasu said its restaurant clients' data could be in scope. The Sanyo Shimbun said Ymirlink told it no leak had been confirmed in the environment it uses. This site's conclusion: people who receive newsletters sent with Cuenote FC should not open links in emails claiming to come from the sender and should check through the official site or app. Client companies should confirm with Ymirlink whether their environment is one of the five systems and decide whether they must report to the Personal Information Protection Commission and notify individuals.