Yamato Holdings' Oct 16 "4th report" confirms exfiltration from the Kuroneko Pay-Later (クロネコ代金後払い) service after unauthorized access identified Sep 28. Scope: ~5.26M customer records (names, addresses, phones, emails, purchase line items, internal order/credit IDs; ~490k include email), ~50k delivery-destination records (name/address/phone/tracking), and ~4,100 merchant records (store name + merchant code). Periods stretch back to 2018 for customer/merchant data. Card numbers and passwords are not included; earlier "invoice amount / receivable balance / employee names" concerns from the 2nd report were not confirmed stolen. No secondary misuse confirmed yet. Yamato already limited external access, reported to the privacy commission, and is notifying affected people. Watch for Yamato-branded phishing.