Yamato Transport confirms 5.31 million records leaked in Kuroneko deferred-payment breach

Yamato Transport said on October 16, 2026, in the final results of its investigation, that about 5.31 million personal information records were taken in the unauthorized access to its Kuroneko deferred-payment service, which lets online shoppers pay at a convenience store after receiving their goods. The company first announced the incident on September 29, after confirming the unauthorized access on September 28; the service was suspended and resumed on October 9. The records cover users from October 2018 onward and include names, addresses, phone numbers, and product details.

The company said the stolen information did not include credit card information or passwords, and that no secondary damage has been confirmed so far.

Sources: Asia Daily; Alo Japan (reporting Kyodo News)