MediumII Cyber Warfare & Critical Infrastructure16 October 2026, Friday

Yamato breach reaches 5.31 million records as Nikkei discloses its own

Parcel carrier Yamato Transport confirmed on 16 October that 5.31 million customer records had been exfiltrated from its pay-after-delivery service. The same day, Nikkei disclosed that 1.83 million records had been taken through a cloud service it used for development.

Location: TOKYO

According to Kyodo on 16 October, Yamato detected unauthorised access on 28 September to its service that lets online shoppers pay at convenience stores after receiving their goods. It suspended the service and restored it on 9 October. The leaked data include customer names and addresses, the names and phone numbers of about 50,000 delivery recipients, and the names of around 4,100 merchants. Credit card details and passwords were not part of the breach.

Jiji reported the same day that the leaked data had been collected over roughly 8 years, starting on 1 October 2018. Sources differ on when the incident was first announced: Jiji says 29 September, while Kyodo gives 2 October. According to Jiji, around 1.83 million Nikkei records containing names, addresses and email addresses were taken through unauthorised access to a cloud service used for system development. Park24, which operates Times Car, said that following its own breach it would finish deleting stored images of identity documents, including driving licences, by the end of October.

In all three cases the attackers went not for the company's core systems but for a connected payment or cloud layer. That suggests the pattern seen in the wave of breaches in early October is continuing. Nikkei has not said which cloud service was involved.

Talay assessment

Bottom line

Japan's wave of breaches has not subsided; the numbers are growing as they firm up. Yamato's 5.31 million records and Nikkei's 1.83 million confirm that attackers are getting in through ancillary layers such as payment and development environments rather than core systems. The most likely path is for more companies to publish final counts through October, and for pressure to mount on the regulator to make third-party service audits binding.

Likely effects

Phishing and fraudNegativeWeeks
With names, addresses and phone numbers leaked together, phishing messages that mimic delivery notifications now have a ready-made target list.
Compliance costs for Japanese firmsNegative1–6 months
Payment and cloud suppliers must each be audited separately, and, as at Park24, stored identity images are starting to be deleted.
Data retentionUncertain1–6 months
Eight years of payment data held in one place shows that the retention period is itself a risk item.

Possibilities, ranked

1
Disclosures keep coming60%
More large companies publish final breach counts by the end of October and the total number of records grows.
Watch: Breach disclosures by Japanese companies and notifications to the Personal Information Protection Commission by the end of October
2
Binding supplier rule arrives25%
The government replaces guidance with binding audit requirements for third-party cloud and payment services.
Watch: A new mandatory draft rule from the National Cybersecurity Office or the FSA
3
Wave fades15%
No further major breach is disclosed and the episode stays confined to the companies already named.
Watch: Whether any new breach of more than 1 million records is announced by early November

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Market reaction

Indicators affected

Yamato records leaked▼ 5.31 million
Nikkei records leaked▼ 1.83 million