Blastmail breach: Rakus Light Cloud confirms all contract holders taken, delivery lists for 344 contracts

Rakus Light Cloud, the Rakus subsidiary that runs the Japanese email newsletter service Blastmail, confirmed that an outside third party broke into two of its API servers, ran commands there, and from them reached its sales-management system and service database and took data out. In its notice updated at 10:00 Japan time on October 25, 2026, the company said information on all Blastmail contract holders was taken from the sales-management system, covering company names, contact names, phone numbers, email addresses, billing email addresses, and contract and payment history. It does not hold credit card numbers. Blastmail has been down since 00:30 Japan time on October 21, with the admin console and API unavailable and mail delivery stopped, and no restart date has been set.

For some customers, subscriber delivery lists and other sending data also leaked. As of the October 25 update, Blastmail had confirmed leaks beyond contract-holder information for 344 contracts and had contacted all 344 individually, and it warned the figure may change as an external investigation continues. Customers have published their own notices with differing wording: Niigata Nippo describes the personal information of up to about 253,000 members as leaked, while H.I.S. Hotel Holdings (about 140,000), Tohoku Electric Power Frontier (up to about 100,000) and JR Shikoku (up to about 30,000) describe their figures as possibly leaked, and the City of Yokohama puts 6,334 volunteer applicants as may have leaked. Those customer figures are each sender's own list count, they may overlap, and no confirmed total subscriber count has been published, so no subscriber total is counted in the records exposed total on this page.

Sources: Europe Says / Rescana, reporting the Rakus Light Cloud and Blastmail notices; Japan Cyber Watch