Ymirlink has replaced its worst-case estimate for the Cuenote FC breach with a confirmed figure: 47,864,147 delivery-target records leaked from 49 systems. The company's third report on the unauthorized access, issued on 11 November, puts the earlier maximum estimate at about 51.62mn records. Readers who want the earlier stage can follow the Earlier Tokyo Brief coverage.
How the count came down
Ymirlink said log matching and database analysis let it identify the records actually output and strip out records it had counted twice. That produced the revised figure for Cuenote FC, the company's mass email delivery service. The 49 affected systems are part of its dedicated ASP environment.
The figure is a running total of records, not a count of people. The company describes it as a cumulative number (延べ in the original), so the same person can appear more than once. The leaked data covers email addresses and attribute information such as names. Email addresses account for the full 47,864,147 records; names account for 6,665,055.
Separate Cuenote BASE exposure
A second system, Cuenote BASE, the company's customer management system, made contract-holder information viewable through a program vulnerability. The affected records number 190 and cover company names, personal names, phone numbers and email addresses. The company counts these apart from the Cuenote FC records. Operation of Cuenote BASE is on hold, with the service run on other systems.
Ymirlink reported no unauthorized access or leakage for its other listed services: Cuenote SR-S, SMS, Auth, Survey, Push and its safety-confirmation service. It said it has not so far confirmed leakage of payment information such as credit card data, and that details of the leaked data items are still being checked.
Why the system count rose
The company said the first report covered 5 systems with direct compromise. A retrospective audit of web access and authentication logs then found that an attacker had used stolen valid session information to download data through the web console's regular CSV export function. That added 45 systems, for 49 in total. Ymirlink said this method involved no installation of malicious programs and no direct database intrusion, and looked like normal administrator activity.
What is still open
An outside security firm is still carrying out the final forensic analysis on the systems where malicious programs were installed. Ymirlink will publish a final report once it receives that firm's findings. It said that, apart from certain Cuenote FC dedicated ASP systems and Cuenote BASE, which are not running, its services are operating normally.
The effect on earnings for the year ending December 2026 is still being assessed, and the company said it will disclose any matter that arises. The report gives no figure for costs or compensation. Ymirlink has reported the incident to police, the Personal Information Protection Commission and JIPDEC, and said procedures with IPA are under way.