23 Daily — According to itmedia.co.jp, on November 11, 2026, Japanese Tokyo-based email distribution service provider Yumirulink announced a data breach due to unauthorized access to their system. Approximately 47.86 million pieces of personal information were leaked, a revised figure from an earlier estimate of up to 51.62 million on October 26. This incident affected multiple companies using Yumirulink’s email distribution services, including major firms such as JR Tokai and @cosme operator Istyle.

Yumirulink’s email distribution system hacked causing extensive data leak

Yumirulink detailed that the breach involved 49 systems under its email distribution service “Cuenote FC.” Leaked data includes over 47.86 million email addresses, approximately 30.5 million member IDs, 6.66 million names, 2.05 million gender entries, about 949,000 birthdates, over 412,000 phone numbers, and 1.82 million postal codes. Other information such as addresses, hashed passwords, company and school names, and client-operated service authentication details were also exposed.

On October 26, Yumirulink disclosed that their customer management system “Cuenote BASE” had 190 records containing company names, personal names, phone numbers, and email addresses accessible externally.

Attackers exploited system vulnerabilities and impersonated users to exfiltrate data

Yumirulink stated that attackers used system vulnerabilities to implant malicious programs accessing databases and stole login state information to impersonate legitimate users and extract data through the admin interface. The breach was detected on October 16, after which patches were applied and malicious code was removed.

Currently, except for some systems still being fixed, main services have resumed normal operation. Yumirulink plans to implement AI-assisted source code reviews and 24/7 monitoring, and will release final investigation results after external experts complete their audit.

Multiple affected companies disclose leaked data, underscoring broad impact

Besides Istyle, which disclosed on November 9 that about 2.8 million customer records were leaked, JR Tokai and two other companies announced on November 5 that approximately 170,000 members’ information from their Shinkansen reservation services “Smart EX” and “Express Reservation” were exposed. This indicates that the data breach affected significant enterprises across industries.

Editor's take: This large-scale data breach highlights security challenges and business risks in email services

Yumirulink’s system vulnerability leading to leakage of nearly 48 million personal data points caused a serious impact on multiple major companies and their users. For entrepreneurs, this incident underscores the critical importance of robust security measures in email and customer data management systems, especially vulnerability management and user access control. Employing AI-based continuous source code reviews and 24/7 monitoring can effectively enhance security. Verification methods such as penetration testing and attack simulation help identify vulnerabilities and evaluate anomaly detection capabilities. Such practices are essential for startups handling email systems or large personal datasets to avoid facing similar scale security crises.