Science & Tech · Cybersecurity · 11 hrs ago
Yumilink says data from about 9 million records may have been exposed
Japanese email delivery provider Yumilink says attackers accessed five systems it manages.
The company said it detected the unauthorized access early on October 16.
A software weakness allowed attackers to obtain login details for staff involved in support and quality control, according to the company.
A malicious program then exported data from Yumilink’s databases.
About 9 million records may be affected, including email addresses, though the company has not confirmed that all the data was taken.
Yumilink disconnected the affected servers, applied a fix and reported the incident to law enforcement.
It is working with outside experts to determine the impact and whether information was leaked.
Yumilink said data linked to about 9 million personal-information records may have been exposed after unauthorized access to its systems.
The company said it found unauthorized access to five systems in the early hours of October 16.
The data included email addresses, and the figure counts records cumulatively.
A vulnerability was used to obtain credentials for staff responsible for support and quality control, according to the Nikkei.
Yumilink said it isolated affected servers, applied fixes and is investigating the impact with outside experts.
- Who
- Yumilink, an operator of email-distribution services.
- What
- Unauthorized access and data output from five systems may have exposed personal information linked to about 9 million records, including email addresses.
- When
- The access was confirmed in the early hours of October 16; Yumilink announced it on October 19.
- Where
- Yumilink's systems. A specific location is not stated.
- Why
- A program vulnerability was used to obtain staff credentials. The motive for the access is not stated.
This story does not have two clearly opposing sides.
Yumilink confirmed unauthorized access to some of its systems.
Yumilink announced that data linked to about 9 million records may have been exposed.
- Affected systems
- 5
- Potentially exposed records
- About 9 million, counted cumulatively
- Data mentioned
- Email addresses and other personal information
- Access confirmed
- Early hours of October 16
- Announcement
- October 19, 2026