Yamato and Nikkei breaches expose 5.31M and 1.83M records

Two more large Japanese companies put numbers on their data breaches on October 16, 2026. Delivery firm Yamato Transport said about 5.31 million records were taken from its pay-later payment service. Newspaper publisher Nikkei said about 1.83 million records leaked from a cloud service it uses to build software. Both cases add to a month of attacks on Japanese firms, and both show the cost of keeping old data around.

Yamato Transport: 5.31 million records

Yamato runs a "Kuroneko" pay-later service that lets online shoppers pay for their purchases later. The company found unauthorized access to it on September 28, stopped the service that night and disclosed the problem on September 29. The service restarted on October 9. Its fourth report, on October 16, gave the totals, ITmedia NEWS reports.

Group	Records, about	Data taken
Buyers, October 1, 2018 to September 28, 2026	5.26 million	Name, address, phone, item details, application number, internal management data; email for about 490,000
Delivery recipients, from February 5, 2021	50,000	Name, address, phone, tracking number
Merchants using the service	4,100	Merchant name and code

Credit card information and passwords were not included, ITmedia reports. The company had earlier warned that employee names might have leaked, but its investigation did not confirm that. It has not said how the attacker got in.

Yamato kept the buyer data for a period to handle customer questions, Jiji Press reports. The buyer records reach back about eight years, to October 2018. Customers have reported suspicious emails, text messages and calls, though no misuse of the stolen data has been confirmed.

Nikkei: 1.83 million records from a development cloud

Nikkei said an attacker got into a cloud service it uses for system development, in the early hours of October 7. The login details for that cloud were stolen "by some means," according to Nikkei's own notice. The company has disabled the stolen credentials.

Of the 1.83 million records, about 150,000 contain at least one of a name, email address, home address, phone number or date of birth. About 120,000 of those include an email address. The other 1.68 million hold only identifiers that cannot name a person on their own, INTERNET Watch reports.

Credit card information was not included, Nikkei says. It reported the leak to the Personal Information Protection Commission, Japan's privacy regulator, on October 11. As of October 16, it had found no misuse of the data, no system outage and no tampering.

It is not Nikkei's first incident this month. On October 4, it disclosed that a hijacked employee account had sent about 9,000 fake emails, ITmedia reports.

A wider wave of disclosures

Japan's government stepped up its cyber warnings on October 9 after more than 20 firms reported attacks. Burger King's Japanese operator disclosed 11.18 million app records a day before these two.

Jiji Press lists other recent cases in the same report:

• Times Car: about 6.6 million records, of which about 1.6 million included driver's license or other ID images. Parent company Park24 says it will delete stored ID images by the end of October, and will now delete them right after checking a member's identity.
• FANCL and its subsidiary Atenia: about 830,000 member records.
• Japan Post: names and addresses of about 600 users of an international mail tracing service.

What this means for developers

• Keep real personal data out of development clouds. Nikkei's leak came from a system used to build software. Use fake or masked data in test and development environments.
• Treat cloud credentials as the front door. Nikkei's attacker logged in with stolen credentials. Use short-lived keys, multi-factor login and alerts on logins from new places.
• Set retention limits and enforce them. Yamato's leak covers eight years of buyers, and Times Car kept ID images years after members left. Delete data you no longer need on a schedule.
• Delete ID images after verification. Park24's new rule is a good default. Once identity is checked, the image of the license has no further use and a high value to criminals.
• Prepare customers for follow-up scams. Names, addresses, phone numbers and order details make convincing fake messages. Tell users what you will never ask for before attackers start calling.