Ymirlink breach grows to 51.6 million records across 49 systems
Japan's Ymirlink confirmed data output on 49 systems of Cuenote FC, its email-delivery service, with 51,628,280 cumulative records possibly exposed, and 16 systems are still being counted. The company says attackers read data across systems through a planted program and hijacked login sessions, but it has seen no public release or misuse, and no threat actor has claimed the attack. Clients including JR Central, JR West and JR Kyushu stopped using the service, and users should watch for phishing emails.
What happened
Ymirlink, a Japanese email-delivery company, confirmed data output on 49 systems of its Cuenote FC service, with 51,628,280 cumulative records possibly exposed, up from about 9 million across five systems in the October 19 first report. Attackers read data across systems through a planted program and hijacked login sessions. Ymirlink says it has seen no public release or misuse of the data, and no group has claimed the attack.
Why it matters
The total may still grow: 16 systems are still being counted. Client companies have already reported exposure of member emails, IDs and names, including JR Central, JR West and JR Kyushu, and the Gundam base members case with 346,247 users, according to Bandai Namco. Scam emails spoofing a card brand have already been seen, so customers of these companies are phishing targets.
What to do
If the company uses Cuenote FC, check with Ymirlink whether its systems are on the list and which fields were exposed. Stop using the affected service, as the JR companies did, and warn customers about phishing and impersonation attempts.
For the technical team
- Affected
- Cuenote FC, serviço de entrega de e-mails da Ymirlink (Japão) · 49 Cuenote FC systems with confirmed data output: 42 found in a retroactive log review on October 25, plus the 5 from the October 19 first report; 16 systems are still being counted. The Cuenote BASE customer system left 190 client-contact records viewable (company, name, phone, email).
- Exploitation
- Data output confirmed by Ymirlink. Scam emails spoofing a card brand have been seen. The company says it has seen no public release or misuse of the data, and no threat actor has claimed the attack.
- Fix
- No fix applicable (data breach). The 42 client companies on systems found on October 25 were contacted by 12:30 JST on October 26.
- Vector
- Cuenote FC email-delivery service from Ymirlink (Japan). According to the company's second report, attackers planted a program and hijacked login sessions to read data across client systems.
- More details
- Second report published on October 26, with a cumulative total of 51,628,280 records, a record count rather than unique people, and exposed fields differ by client, per DailyDarkWeb. JR Central, JR West and JR Kyushu said on October 26 that email addresses, member IDs and names of some Express Reservation and smartEX members were exposed through the service; they stopped using it and say their own reservation systems were not breached. Source @Pirat_Nation reports 346,247 users of THE GUNDAM BASE MEMBERS with email addresses and internal Bandai Namco ID numbers exposed via the email handler for Bandai Namco ID (spelled 'Yumillink' in that source); passwords, credit card details, names, addresses and purchase history were not affected, according to Bandai Namco, which stopped the affected email service.
Timeline
Ymirlink's second report expands the case from about 9 million to 51.6 million possibly exposed records across 49 systems.
Incident opened.
Sources 2 sources
- @Pirat_Nation @Pirat_Nation
- @DailyDarkWeb @DailyDarkWeb
