ENKR

Yamato Transport Kuroneko deferred-payment data breach

Add to my breach check

Made public

What leaked6

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Purchase or order history
  • Full name
  • Mobile numberphone number · type not stated
  • Home or delivery addressusers and delivery recipients
  • Purchase or order historyitem details · product name, quantity, unit price; tracking numbers for deliveries
  • Email addressabout 490,000 records
  • Full nameusers, and recipients' names for about 50,000 deliveries
  • Other profile datainternal management data · application number, order date, credit approval number

To-dos3 · about 30 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  3. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next8 events

  1. UndetectedNone on record
  2. Response 8 eventsNotice in 18 days · show events
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record
  1. Yamato Transport: no secondary harm from unauthorised use of the information confirmed so far
  2. Affected people to be contacted individually; the report serves as notice for those who cannot be reached
  3. Fourth report: about 5.26 million user records, about 50,000 delivery records and about 4,100 merchant records were taken
  4. Second report: some information may have leaked
  5. First notice of the unauthorised access
3 more
  1. Service stopped at 22:28 after outside access was restricted
  2. Unauthorised access to the Kuroneko deferred-payment service confirmed
  3. Reported to the Personal Information Protection Commission
Company
Yamato Transport
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
5,260,000 records of service users from October 1, 2018 to September 28, 2026 · about 490,000 with email addresses; plus about 50,000 delivery-recipient records and about 4,100 merchant records

How the facts developed

  1. Fourth report: about 5.26 million user records were taken; billed amounts, balances and staff names were not found to have been taken
  2. Second report: names, addresses, phone numbers, email addresses, credit approval numbers, billed amounts, balances and item details of some users may have leaked, plus merchants and staff names

Sources