Yamato Transport Co. said Thursday that unauthorized access to its Kuroneko deferred-payment platform exposed personal data on roughly 5.31 million customers and merchants, one of the largest logistics-sector leaks disclosed in Japan this year.
Parent Yamato Holdings Co. published a fourth update on the incident, confirming that attackers reached the pay-later system on 28 September and that investigators have now tallied the full scope of records copied. The company said it has reported the breach to Japan's Personal Information Protection Commission and hired outside forensic specialists after blocking external access.
What was taken
According to the disclosure, about 5.26 million customer files linked to Kuroneko pay-later use between October 2018 and 28 September 2026 included names, addresses, phone numbers, product descriptions, and internal order identifiers. Email addresses appeared in roughly 490,000 of those records. Another 50,000 delivery-address entries and about 4,100 merchant records were also removed.
Yamato stressed that credit-card numbers, passwords, and authentication credentials were not stored in the affected databases and therefore were not part of the exfiltration. Kyodo News and Nikkei reported the totals on Friday morning in Tokyo, amplifying scrutiny of a carrier that handles a large share of Japan's parcel volume.
Operational fallout
The Kuroneko brand is ubiquitous on doorsteps across Japan, and pay-later checkout is embedded in many e-commerce flows. Yamato said it has not confirmed follow-on misuse of the stolen files, but security researchers warn that pairing names, addresses, and purchase histories enables convincing phishing and bogus billing messages.
ITmedia noted that product line items in the leak could reveal sensitive purchases, raising reputational risks beyond basic identity misuse. Yamato pledged additional monitoring for affected users and merchants, without detailing compensation or credit-monitoring offers in the initial English-language summaries.
Regulatory clock
Japan's amended privacy rules require prompt notification when large-scale personal data leaves corporate control, and parliamentary debates have repeatedly singled out logistics and retail platforms as weak points. The breach lands as other Japanese firms, including parcel rival Sagawa Express's ecosystem partners, face heightened audits after a series of mid-2026 incidents.
For Yamato, the next tests are whether regulators classify the event as reportable harm, how quickly merchants must notify their own customers, and whether corporate customers renegotiate data-processing clauses. Friday's confirmation number — 5.31 million — is now the benchmark investors and insurers will use when judging the group's cyber-resilience spending.
Shares in Yamato Holdings slipped in Tokyo morning trade as analysts asked whether incident-response costs would appear in the next quarterly outlook. The company has not revised earnings guidance, but logistics peers are watching for class-action filings from merchants who relied on Kuroneko billing data in their own compliance audits.