Yamato Transport: 5.31 million pay-later records confirmed leaked
Yamato Transport said on October 16, 2026 that about 5.31 million personal information records of users of its Kuroneko deferred payment service had been leaked, including names, addresses and telephone numbers.
What happened
Yamato Transport, Japan's major parcel delivery company, said on October 16, 2026 that about 5.31 million personal information records belonging to some users of its Kuroneko Daikin Atobarai deferred payment service had been leaked following unauthorised access to the service's system. Yamato first announced the incident on September 29, after confirming unauthorised access on September 28 and suspending the service; the service resumed on October 9. Its October 2 report said customer information may have leaked, and the October 16 announcement is the company's confirmed result: the leak also included about 50,000 records with package recipients' names and phone numbers and about 4,100 records with the names of companies and stores that sell products online.
Who is affected
Some users of the pay-later service, which lets online shoppers pay at a convenience store after receiving their goods. The affected information collected from October 1, 2018 onward includes names, addresses and telephone numbers, and Yamato's earlier report also listed email addresses, credit reference numbers, billed amounts, outstanding balances and item details for some customers. Credit card information and passwords were not included, according to the company.
How serious
The concrete risk is targeted payment fraud and phishing: a name, address and phone number combined with what someone bought, how much they were billed and how much they still owe is exactly what a convincing fake payment reminder needs, whether it arrives by email, text, phone or post. Yamato says no secondary damage has been confirmed so far, but the data covers roughly eight years of service use, so the exposure is not limited to current customers.
What to do now
Treat any payment reminder for this service as suspect until you verify it through a channel you already know: check the shop you bought from or contact Yamato through its official site, and do not pay to a new account or follow a link in an unexpected message. If you used the pay-later service since October 2018, watch for messages that cite a real item or a real amount owed — those details are no longer proof a message is genuine.
Sources: Kyodo via Alo Japan · Japan Cyber Watch · Asia Daily