TL;DR
- 01What happened
On October 19, 2026, Yumirlink disclosed unauthorized access to part of its Cuenote FC email delivery service, with personal data taken out. Through a program vulnerability, attackers obtained support and quality staff credentials, installed a malicious program and output data from databases — about 9 million records with email addresses across five single-customer systems, by the company’s estimate.
- 02Why it was hard to tell
The credentials belonged to the provider’s staff, not to a customer. The attackers also tried them on other systems, and Yumirlink says it removed the staff information from other systems.
- 03The missing layer
Yumirlink noticed early on October 16, and its access logs showed the data had already been output. What failed was the layer that checks a provider staff login against which customer’s request it is for.
What happened
- The service
- Cuenote FC is an email delivery service companies and local governments use to send newsletters and notices in bulk. Five systems managed by Yumirlink on the “dedicated ASP plan”, which gives each customer its own system, were affected (per Yumirlink).
- The route
- Through a program vulnerability, attackers obtained support and quality staff credentials for the service. They installed a malicious program and output data from databases, and used the staff credentials to attempt authentication to other systems (per Yumirlink).
- Not disclosed
- Which program was vulnerable, when the intrusion began, how many staff and what rights they had, whether MFA was used, whether the data output used the staff credentials, whether the attempts on other systems succeeded, and which customers the five systems belong to.
- What was output
- Information including email addresses, about 9 million records cumulative (estimate). The deduplicated number of people has not been disclosed. Some customer and municipal disclosures list names, company names, industry and internal ID numbers.
- Customer and municipal disclosures
- Dai Nippon Printing (honto) was told that newsletter subscribers’ name, email address and ID number may have leaked. Saitama Prefecture said data on 669 parties in a newsletter run by its contractor may have leaked. NTTPC said no impact was confirmed but could not be ruled out. Others said no leak was confirmed.
- Yumirlink’s response
- It immediately cut the affected servers off the network, built and applied a fix for the vulnerability, and removed the staff information from other systems. It reported to investigators and is investigating with outside experts. Its support site says customers must now register source IP addresses for the admin console and API.
Glossary
Cuenote FC — Yumirlink's email delivery service, used by companies and local governments to send member notices and newsletters in bulk. The "dedicated ASP plan" gives each customer its own system.
Support and quality staff — Staff at the provider (Yumirlink) who handle customer inquiries and check quality on customer systems.
Credentials — The ID, password and the like used to enter a system. If taken, they can be used with the owner's rights.
The stopping point is ④. Had each provider staff login been matched to which customer's request it was for, authentication to systems with no request would not go through. Whether the attempts on other systems succeeded, and how ③'s output was done, have not been disclosed.
Which program has not been disclosed.
The provider's staff.
Five systems, about 9 million records (estimate).
Whether it succeeded has not been disclosed.
Timeline — disclosure and response
- Early morning, Yumirlink staff confirm unauthorized access on some systems. The servers are immediately cut off the network.
- From around 14:15, San-yo Shimbun’s news-alert emails can no longer be delivered (per San-yo Shimbun). In its second notice the next day, the paper linked this to its delivery contractor, Yumirlink.
- Yumirlink posts a notice on its support site and files its first report at 17:05. At 19:05 it adds Cuenote FC and the five dedicated-ASP-plan systems to the version on its own site.
- Saitama Prefecture, NTTPC, municipalities and others disclose the impact on their users. Oe Town in Yamagata adds at 11:00 the same day that no leak was confirmed.
- Dai Nippon Printing discloses a possible leak of honto customer data.
The facts rest on Yumirlink’s first report and on customer and municipal disclosures (all primary). Yumirlink’s report says in its body that taking the data out “was confirmed”, while its heading speaks of “systems that may have leaked”. It says the staff credentials were “used” only for the attempts on other systems; for the data output it says a malicious program was installed. As of October 23, no second report had been issued.
After disclosure
- Yumirlink: Lists fixing the vulnerability, deleting the staff credentials and setting up detection of malicious programs as preventive measures. It says it does not currently accept settings that allow access to the admin console and API from any source. The impact on earnings is under review.
- Customers and municipalities: Some paused and resumed delivery, and some cut their link to the delivery system. They warn about spoofed email.
Why it wasn’t stopped
This case was not only about a vulnerability. The provider’s staff credentials, once taken, were also used in attempts to authenticate to other systems, without being tied to any customer’s request for work.
The provider's staff credentials, not tied to any customer's request for work, were also used in attempts to authenticate to other systems.
Proof here means checking, before provider staff enter a system, that "this customer has requested this work", and recording that. Detection means noticing after unauthorized access has happened.
were attempted
Detection worked: Yumirlink cut the servers off and removed the staff information from other systems. But “holding provider staff credentials” and “this customer has requested this work” are separate facts, and the disclosures show no layer matching the first to the second. That distance is the detection–proof gap, and it is a structural one.
The same structure appears in ConnectWise’s app identities (a vendor’s credential let operations in customer tenants go through); there an app changed permissions, here a person’s staff login reached toward systems outside its assignment.
How to counter this
Each time provider staff enter a customer’s system, match it to which customer’s request the work is for. Then stolen credentials alone cannot open systems with no request. This is not a substitute for detection; it sits in front of it.
Industries and operations to watch
- IndustryGovernment & public sector
- Local governments that send notices and business newsletters through outside delivery services. When a contractor holds the contract, it is hard for the government to see where the recipient list sits and on which plan.
- IndustryProcurement & supply chain
- Companies that entrust member and customer newsletters to a delivery SaaS, sometimes syncing names and internal IDs for delivery.
- OperationAccounts & permissions
- Managing provider staff accounts placed in your delivery environment, and source settings for the admin console and API.
Do today’s controls close it?
| Control | This case | Why |
|---|---|---|
| Fixing the vulnerability | Partial | It closes the entry, but fixing it alone does not change what a credential holder is allowed to do. |
| Customers’ MFA | Not relevant | The credentials taken were the provider’s staff credentials. |
| Restricting source IPs for the admin console and API | Partial | It narrows the customer-side entry. Whether it would stop provider staff logins is not clear from the disclosures. |
| Intrusion detection | Partial | It noticed after the access logs showed the output had happened. |
- Tie staff logins to the customers and work they are assigned. Do not keep staff information on every system at all times. Removing it from other systems, as Yumirlink did, points this way.
- Match each entry to a customer’s request before letting it through. Refuse logins not tied to a request, such as an inquiry number, even with the right password, and time-limit the ones allowed.
- Record which request led into which customer’s system. Keep it separately from the provider, in a form customers can check later: in other words, as proof.
Three things to confirm in your organisation about SaaS that holds your data, such as email delivery
- Have you limited the admin console and API to your own IP addresses, rather than leaving them open to all?
- Does your recipient list carry fields you don’t need for delivery, such as names, industry or internal IDs?
- Is there an agreement that the provider will tell you, after an incident, whether you were affected?
Note: if a malicious program on the server reads the database directly, data can be output without passing this check; it cannot be said that this mechanism would have stopped the roughly 9 million records here. Misuse within an assigned customer’s request also passes. How the data was output and whether the attempts on other systems succeeded have not been disclosed yet. If follow-up reports reveal them, this Brief will be revised.
Sources
- Primary, timely disclosureYumirlink Report on unauthorized access to our systems (first report)
- Primary, company disclosureYumirlink Report on unauthorized access to our systems (first report, 19:05 update)
- Primary, support siteYumirlink Cuenote ASP service: report on unauthorized access (service status)
- Primary, customer disclosureDai Nippon Printing Possible leak of customer data due to unauthorized access at an outside contractor
- Primary, customer disclosureNTTPC Possible leak of email addresses and other data following unauthorized access at Yumirlink
- Primary, municipal disclosureSaitama Prefecture Possible personal data leak following unauthorized access at Yumirlink
- Primary, municipal disclosureOe Town Unauthorized access at the company running the town’s registered email system
- Primary, customer disclosureSan-yo Shimbun Suspension of email delivery services (second notice) and unauthorized access at a contractor
1 more (reporting, analysis)
- PressNHK Email delivery company for businesses and local governments breached, 9 million records may have leaked
References: “The last layer left in AI-era cyber defense”