JP — ITmedia

Unauthorized Access to Email Delivery Provider Yumilink; About 9 Million Records Including Email Addresses Possibly Leaked

SecurityOctober 20, 20261 min read

Yumilink, a Japanese company that runs an email delivery service, says hackers broke into some of its servers. Personal data, including about 9 million email addresses, may have been taken.

What happened

Yumilink said on October 19 that some server systems of its main email service, Cuenote FC, were attacked from outside. Customer personal data was taken out. The attacker used a weakness in a program to steal login details of a support and quality control staff member. Then the attacker put a harmful program on the system and copied data from the database. The attacker also tried to log in to other systems with the same details. Yumilink cut the affected server off from the network, made a fix for the weakness, and removed the staff login data from other systems.

Key numbers

About 9 million records were copied in total, including email addresses (estimated).
5 systems in the dedicated ASP plan were confirmed as attacked.
The attack was found early on October 16.
Cuenote series sends about 8.9 billion emails and SMS messages a month.
More than 2,900 companies and government offices use the system.

What is an email delivery service?

Companies use services like Cuenote to send large numbers of emails, such as newsletters and notices, to their customers. Because these services hold so many email addresses, a break-in can affect many people at once.

Why it matters

Many people and organizations depend on this service. If personal data leaks, people may get spam or scam emails. The company says the effect on its business for the year ending December 2026 is still being checked.

What to watch

Results of the detailed investigation with outside experts.
Any new facts Yumilink reports later.
How the company's business results are affected for the year ending December 2026.

Glossary

Cuenote FC: An email delivery service from Yumilink that companies use to send emails and SMS to customers.
ASP: A way to use software over the internet, where the provider runs the system for you.

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.