JR Smart EX and Express Reservation member email addresses possibly leaked, about 170,000 records, after unauthorized access to Yumilink

What happened

JR Tokai, JR West and JR Kyushu announced on October 26 that some members of their bullet train booking services, Express Reservation and Smart EX, may have had personal data leaked. The data came from Yumil Link, an email delivery company that the JR companies use. Yumil Link was hacked. The JR companies say they have not found any leak from their own systems.

Key numbers and facts

• About 170,000 records may be affected. The number is still being checked.
• Leaked data: some members' email addresses, member IDs, names written in katakana, and membership types.
• Credit card information was not leaked.
• The emails were sent through a service called Cuenote FC. They included some ads and notices that a train's departure time had changed because of the 2016 Kumamoto earthquake.

Why the news changed

On October 16, Yumil Link was hacked. At that time, it told the three companies that Express Reservation and Smart EX users were not affected. On October 26, Yumil Link said that users' personal data had been seen or taken by outsiders. The companies stopped using the hacked email service and reported the case to the Personal Information Protection Commission, which is Japan's government office for privacy rules.

Why it matters

Leaked email addresses and names can be used for scam emails or fake messages. Members who get these messages should be careful. The story also shows that a company's safety can depend on its partners. Even if a company's own systems are safe, a problem at a company it works with can still expose customer data.

What to watch

• The final number of affected people, which is still being checked.
• The companies will contact affected members by email or other methods.
• Whether the Personal Information Protection Commission asks for more action.
• Whether more companies that used Yumil Link report leaks.