Ymirlink, the Tokyo Growth-listed operator of an email delivery service, said an outside intruder extracted personal information from some of its server systems. In a first report dated October 19, 2026, the company estimated that about 9 million cumulative records, including email addresses, were output from five systems it manages.
What the company says happened
A company staff member found the unauthorized access in the early hours of Friday, October 16, 2026. According to Ymirlink, its review of access logs showed four things: the attacker exploited a program vulnerability; obtained credentials for the service held by support and quality-control staff; installed a malicious program and output data from databases; and used those staff credentials to try to authenticate into other systems.
The company says it cut the affected server off from the network at once. It also says it built and applied a fix for the vulnerability and deleted the support and quality-control staff information held on other systems.
The scale, and its limits
Ymirlink confirmed unauthorized access and data output on a total of five systems. The roughly 9 million figure is the company's own estimate of cumulative records, which is not a count of unique individuals. Ymirlink says the details of the data output are still under investigation.
Response and what is pending
As prevention measures, the company lists the fix to the vulnerable program, removal of the staff credentials, and a detection setup for malicious programs. It has also notified investigative authorities and says it will carry out a detailed investigation with outside experts. It promises a further report when new facts emerge.
On financial impact, Ymirlink says the effect on its results for the year ending December 2026 is under review, and that it will disclose promptly if anything requires it. The report does not say how many customers or end users are affected or whether notification of individuals has begun. The company has set up a dedicated inquiry line (03-6820-0088, weekdays 9:00 to 20:00) and an email address, [email protected].