Ymirlink, the Tokyo Growth-listed email-delivery provider, has widened its account of a cyberattack on its Cuenote services. In a second report dated October 26, 2026, it said email addresses and other data were output from 49 Cuenote FC systems, with a cumulative 51,628,280 records at risk of leakage. The company warned that the figure could rise.
What the second report adds
Cuenote FC is Ymirlink's bulk email delivery service. The report counts 78 single-company systems on which access was attempted, and traces of leakage on 49 of them. Three systems shared by multiple companies were also targeted, and the report shows no leakage traces and no records at risk on those.
The company says 16 systems remain under investigation for how many records leaked, so the cumulative total may increase. The report calls the figure a cumulative count, so it is not a count of unique individuals.
It also reports that analysis of the malicious programs and system logs identified 45 newly affected systems: 44 on Cuenote FC and one on Cuenote BASE, the company's customer-management system. On these, the attacker referenced data on other systems and took session information at login to log in improperly.
The timeline shows that on October 25 at 21:45 the company confirmed unauthorized access and data-output records on 42 more systems. It contacted those 42 customers at 12:30 on October 26.
Other services and the stated cause
Ymirlink attributes the Cuenote FC leakage to a library vulnerability. On Cuenote BASE, a program vulnerability left subscriber contract information viewable, covering 190 records of company name, personal name, phone number and email address. It reports no leakage or other impact on Cuenote SR-S, SMS, Auth, Survey, Push or its safety-confirmation service.
The company detected the intrusion on October 16. It lists remediation steps including patching the vulnerabilities, deleting support and quality-control staff credentials from other systems, continuous monitoring for malicious programs, and IP restrictions on login screens and APIs. It has notified the Metropolitan Police Department, the Personal Information Protection Commission and JIPDEC. It will report to the Information-technology Promotion Agency (IPA) once the full picture and cause are established.
Phishing warning and open questions
Ymirlink says it has found no evidence that leaked personal data has been made public or misused. It has, however, confirmed multiple unsolicited emails that use its cuenote.jp domain to impersonate third parties, including messages posing as Saison Card with subject lines such as "Request to confirm your use". The company says neither it nor the third parties sent them, says they may be fraud, and warns customers about fake emails and SMS messages that could exploit the incident.
The company recommends that customers change their Cuenote passwords, and any reused passwords elsewhere, and enable two-step authentication where possible. It says it will never ask customers for passwords, authentication codes or credit card details by email, SMS or phone.
The address-book contents differ by customer company, so the report says it will give details once its investigation is complete. It is still assessing the effect on earnings for the year ending December 2026 and says it will disclose any matters as they arise.