Ymirlink (ユミルリンク, TSE 4372), which runs the Cuenote FC bulk email platform used by Japanese companies, local governments and police alert-mail services, disclosed on Oct 19 that personal data was taken from part of the service. Its first report says staff found the intrusion in the early hours of Fri Oct 16. Ymirlink's access logs showed that the attacker (1) exploited a vulnerability in a program, (2) obtained the service credentials of Ymirlink's own support and quality-control staff, (3) installed a malicious program and exported data from the database, and (4) tried those staff credentials against other systems.

Five Cuenote FC dedicated ASP plan systems had data exported. Ymirlink estimates a cumulative ~9 million records including email addresses. Exactly which fields were taken is still under investigation. The company isolated the servers, built and applied a fix, removed the staff credentials from other systems, and reported the incident to police. Customers are now publishing their own notices. For example, NTTPC and several municipalities have published notices about possible exposure of their subscribers' email addresses.

Do now: if your organization sends through Cuenote FC (especially a dedicated ASP plan), ask Ymirlink whether your system is one of the five and what fields it held. Prepare a phishing warning for your mailing-list subscribers, since stolen lists from a mail provider are ideal for spoofed "from your bank or city" campaigns. Check your DMARC policy is at p=reject or quarantine for the domains that send through it. The pattern here, a vendor's own support accounts being reused across customer systems, is worth checking with every email or SaaS provider that has standing access to your tenant.