Rakus Light Cloud, the Rakus subsidiary that runs the Japanese email newsletter service Blastmail (ブラストメール), says an outside third party broke into its systems and took data out. In its notice updated at 10:00 Japan time on 25 October 2026 (03:00 Cyprus time, UTC+2), the company says it has confirmed that information on all Blastmail contract holders was taken from its sales-management system. That data covers company names, contact names, phone numbers, email addresses, billing email addresses and contract and payment history. Rakus Light Cloud says it does not hold credit card numbers. For some customers, the company says, information about their mail delivery, such as subscriber (delivery) lists, also leaked. As of that update, Blastmail said it had confirmed leaks beyond contract-holder information for 344 contracts and had contacted all 344 individually. It warns that the figures may change as an external investigation continues.

Blastmail has been down since 00:30 Japan time on 21 October (18:30 Cyprus time on 20 October). The admin console and API are unavailable, mail delivery stopped at about 01:00 Japan time the same day, and there is no restart date. The company says the intruder got into two of its API servers, ran commands there, and from them connected to the sales-management system and the service database to take the data. It has not said how the intruder got in. Its next update is due around 10:00 Japan time on 26 October (03:00 Cyprus time).

Some facts are less alarming. A confirmed leak of subscriber lists is limited to the contracts Blastmail has notified; for many senders the leak is still only possible, and several have said so in their own notices. Japan’s Ministry of the Environment, for example, says the lists for six ministry-related newsletters may have leaked but that no leak has been confirmed. None of the Blastmail, Rakus or ministry notices reports misuse of the data. Rakus paused seven other services as a precaution and restored them on 22 October, saying it found no unauthorized access or leak in them. No CVE has been linked to the incident.

Technical Information

What the service is. Blastmail is a hosted bulk email service that organisations use to send newsletters and announcements to their own subscribers. The sender uploads or collects a subscriber list on the platform, and Blastmail delivers the mail. Rakus Light Cloud is a wholly owned subsidiary of Rakus (株式会社ラクス 100％子会社), per the vendor’s notice.

What Blastmail and Rakus have said (Blastmail notice, updated 25 October; Rakus first report, 21 October; Rakus second report, 21 October; all Japanese):

Detection and shutdown. Rakus’s first report says it detected suspicious access (不審なアクセス) to Blastmail and stopped the service as an emergency measure from 00:30 Japan time on 21 October. It reported the incident to Japan’s Personal Information Protection Commission (PPC) and to JIPDEC, the body that runs Japan’s PrivacyMark scheme.
Confirmation. The second report, the same day, says investigation confirmed unauthorized access (不正アクセス) by an outside third party and that data including customers’ personal information was taken out (外部に持ち出された).
Contract-holder data. Both the second report and the vendor notice say information on all contract holders (すべてのご契約者さま) was taken from Rakus Light Cloud’s sales-management system: company name, contact name, phone number, email address, billing email address, and contract and payment history, among other items. Credit card numbers are not held by the company.
Delivery data. For some customers, information about mail delivery, such as subscriber lists (配信先リスト), also leaked. As of the 25 October update, Blastmail said the number of contracts with a confirmed leak beyond contract-holder information was 344, that individual contact was complete for all 344, and that the figure was unchanged since its 11th report (第11報). It adds that both figures are current values that may change as the external investigation progresses.
Cause. “An outside third party intruded into two of our API servers and executed commands, then from there connected to our sales-management system and the service database and took data out.” (外部の第三者が、弊社の API 用のサーバー 2 台に侵入してコマンドを実行し、そこから弊社の販売管理システムとサービスのデータベースに接続して、データを持ち出しました。) The details of the intrusion route are still under investigation (侵入経路の詳細は調査中です).
Latest status. The 25 October update says an external investigation by a specialist organisation continues and that there is no newly confirmed information or progress to report since the 24 October 13:20 update.

Timeline (Japan time, with Cyprus time in brackets: UTC+3 until 25 October, UTC+2 from then):

21 October, 00:30 (20 October, 18:30): Blastmail is stopped after suspicious access is detected; the admin console and API go offline. Mail delivery stops at about 01:00 (19:00).
21 October: Rakus publishes its first report (suspicious access, service stopped, PPC and JIPDEC notified), then its second report confirming unauthorized access and data exfiltration. Rakus also pauses seven other services, including Rakuraku Hanbai, Rakuraku Kintai and Rakuraku Mail Marketing, as a precaution, saying no unauthorized access or leak had been confirmed in them (Rakus, 21 October).
22 October: Rakus restores the seven services and its corporate, product and support sites, saying its maintenance found no unauthorized access or leak in those services (Rakus, 22 October). Customers start publishing their own notices (see below).
23 October: Blastmail opens a joint report option for customers to file with the PPC (Blastmail, 23 October). giftee’s notice, quoting the vendor, says that as of 14:00 (08:00) leaks of delivery information had been confirmed for 288 contracts, all contacted (giftee, 23 October). Japan’s Ministry of the Environment publishes its notice (MoE, 23 October).
24 October, morning: Per Niigata Nippo’s fourth report, Blastmail confirms leaks for 56 further contracts on top of the 288 (Niigata Nippo, 24 October), which matches the 344 total on the vendor page.
25 October, 10:00 (03:00): Latest Blastmail update. Nothing new confirmed; 344 unchanged; restart still undecided.
26 October, around 10:00 (03:00): Next Blastmail update due.

Japan’s Ministry of the Environment. The ministry’s press release of 23 October says unauthorized access by a third party to Blastmail means the subscriber information of several ministry-related newsletters “may have leaked” (漏えいした可能性がある). It adds: “At this time, it has not been confirmed that subscriber information was leaked.” (現時点において、配信先情報の漏えいがあったとは確認されておりません。) The ministry lists six newsletters and what each may expose:

Newsletter (per MoE)
Information that may have leaked

Global Environmental Outreach Centre (GEOC) newsletter
Email address, attributes

Regional Circular and Ecological Sphere newsletter
Email address, name, attributes

Tohoku Environmental Partnership Office (EPO) newsletter
Email address

Fukushima Environmental Restoration Plaza newsletter
Email address

Kanto ESD Centre newsletter
Email address, attributes

Kinki Environmental Partnership Office newsletter
Email address, name, affiliation, prefecture and municipality, remarks (reason for registering)

The ministry’s release gives no record count. Media reports of a figure for these newsletters are not on the ministry page, so we do not repeat one here. GEOC’s own notice, as of 13:20 Japan time on 24 October, repeats that no leak has been confirmed and warns subscribers about phishing and fake apology emails.

What other customers have said. Many Blastmail customers in Japan have published notices. Their wording differs, and the difference matters: a few say a leak is confirmed, most say it is possible. A sample, each in the customer’s own words:

Niigata Nippo (regional newspaper) says personal information of all members of its “Niigata Nippo Passport” service leaked, up to about 253,000 people: name in katakana, prefecture, municipality, email address, gender, age band, subscribed products and newsletters. It says no credit card, phone, birth date, account or password data was involved, and no misuse has been confirmed (second report, 22 October).
H.I.S. Hotel Holdings says the names and email addresses of about 140,000 hotel members may have been taken; no card data was included (22 October).
Tohoku Electric Power Frontier says it has not yet confirmed whether its e-Point Mall members are among the leaked data, but is treating up to about 100,000 email addresses and internal member IDs as possibly leaked. It says names, addresses, phone numbers, passwords, card, bank and utility contract data were never shared with the service, and the internal ID alone cannot be used to log in (22 October).
JR Shikoku says it cannot rule out that name, date of birth, address and email address of up to about 30,000 tour newsletter subscribers were viewed or obtained (22 October, PDF).
City of Yokohama says the names and email addresses of 6,334 volunteer applicants for its GREEN×EXPO 2027 area may have leaked (22 October, PDF).
JEMAI (Japan Environmental Management Association for Industry) says its list of about 15,000 newsletter subscribers may have leaked and that it has reported to the PPC (23 October).
JAPEX says email addresses of its newsletter subscribers, and contact details of investors and analysts on an events list, may have leaked; counts are under investigation, no misuse is confirmed, and its own network is not affected (21 October).
giftee says the vendor confirmed its contract was not among the 288 contracts confirmed as of 23 October (23 October).

ITmedia also reports notices from Kurashicom and Nulab. Each figure is that sender’s own count of the members or subscribers on its list. Only Niigata Nippo describes its figure as a confirmed leak; the others describe people whose data may have leaked. The lists may overlap, so the figures should not be added together.

National CERTs and wider context. As of 25 October 2026, 11:56 Cyprus time (UTC+2), neither JPCERT/CC nor IPA has published anything naming Blastmail. Both have issued general warnings about a wave of intrusions and data leaks at Japanese organisations since about September. JPCERT/CC’s alert JPCERT-AT-2026-0030 (updated 23 October) describes several attack types, including abuse of application APIs; it does not say that every case uses the same method, and it does not link any case to Blastmail. IPA’s 9 October alert asks organisations to review their internet-facing applications, list every external service they use, and check those services’ logs and accounts for anything unusual. We cite these as context only. Our earlier posts on Japan’s National Cybersecurity Office supply chain advisory and the IDCF Cloud ransomware incident cover the same period.

No CVE has been assigned or linked to this incident, so there is nothing to check in CISA’s Known Exploited Vulnerabilities catalog.

Affected Product Versions

This is a service incident at a hosted provider, not a software vulnerability, so there are no product versions to patch.

Item
Scope (per Blastmail / Rakus)
Status (per Blastmail, 25 October, 10:00 Japan time)

Blastmail service
All customers
Down since 00:30 Japan time, 21 October; admin console and API unavailable; delivery stopped about 01:00. Restart date undecided

Contract-holder data
All Blastmail contract holders
Confirmed taken from the sales-management system: company, contact name, phone, email, billing email, contract and payment history

Credit card numbers
Not held by Rakus Light Cloud
Not affected, per the vendor

Delivery data (subscriber lists and similar)
Some customers
Leak confirmed for 344 contracts, all contacted individually; figure may change

Other Rakus services (seven named)
Paused as a precaution, 21 October
Restored 22 October; no unauthorized access or leak found, per Rakus

Workaround and Mitigation

Blastmail has not published a list of customer actions. The steps below are our guidance, built from what Blastmail and its customers have said; where a step goes beyond those notices, we say so.

For organisations that send through Blastmail:

Check whether your contract is among those notified. Blastmail says it has contacted every contract with a confirmed delivery-data leak. If you have not heard from it, ask support to confirm your status in writing, as giftee did, and recheck after each update, since the count has moved before.
Assume your contract-holder details are known. Blastmail confirms these were taken for all customers. Brief staff named on the account, and your finance team, to expect convincing phishing that quotes your company name, contact names, billing address or payment history, including fake invoices or payment-change requests.
Decide on regulator and subscriber notices. If you handle the personal data of people in Japan, consider your reporting duty to the PPC. Blastmail offers a joint report filed with the vendor; applications close on 29 October 2026 (joint report page). Blastmail notes that a joint report covers the PPC only. Customers whose lists are confirmed leaked must still notify their own subscribers, and PrivacyMark holders must report to JIPDEC themselves.
Warn your subscribers. Post a notice on your site, since you cannot email your list through Blastmail while it is down. GEOC, JEMAI and others warn that leaked addresses may be used for phishing and fake apology emails.
Plan for the outage. There is no restart date. If newsletters, alerts or transactional mail depend on Blastmail, decide whether to pause them or move to another sender, and keep a copy of your subscriber list outside the platform.
Rotate anything connected to Blastmail (Rescana guidance, not a vendor instruction). If your systems call the Blastmail API or hold credentials for it, rotate those keys and passwords when service returns, and review your logs for unusual calls. We suggest this as a precaution only: Blastmail has not said whether customer API credentials were among the data taken.

For subscribers who receive mail sent through Blastmail: treat unexpected emails about this incident with care, do not open links or attachments in them, and check announcements on the sender’s own website.

Indicators of Compromise

Blastmail and Rakus have published no indicators of compromise and no intrusion route. JPCERT/CC’s general alert lists indicators for the wider wave of incidents, but it does not tie any of them to Blastmail, so we do not repeat them here. We have no IOCs to share. No source maps this incident to MITRE ATT&CK, and we have not done so either.

What we will update

We will update this post after Blastmail’s next report (due around 10:00 Japan time on 26 October), and if Blastmail changes the 344 figure, sets a restart date, discloses the intrusion route or says which data in the service database was taken; if Japan’s Ministry of the Environment confirms or rules out a leak for its newsletters; if a customer reports misuse of leaked data; or if JPCERT/CC, IPA, the PPC or another authority publishes something specific to Blastmail.

Sources

Rakus Light Cloud (Blastmail) (Japanese)

「【重要】ブラストメールの緊急停止および個人情報漏えいに関するお詫びとご報告」 (“Important: Apology and report on the emergency stop of Blastmail and the personal information leak”), updated 25 October 2026, 10:00 JST: https://info.blastmail.jp/information_20261021.html
「個人情報保護委員会への連名報告に関するご案内」 (“Guidance on joint reports to the Personal Information Protection Commission”), 23 October 2026: https://info.blastmail.jp/information_joint_report.html

Rakus (Japanese)

Government (Japanese)

Customer notices (Japanese)

National CERTs (context only; neither names Blastmail; checked 25 October 2026, 11:56 Cyprus time, UTC+2)

ITmedia

「メール配信サービスの契約者情報全て漏えい　横浜市やJR四国などに影響　ラクス子会社に不正アクセス」 (“All contract-holder data of email delivery service leaked; Yokohama, JR Shikoku among those affected; unauthorized access at Rakus subsidiary”), 23 October 2026 (Japanese): https://www.itmedia.co.jp/news/article/2610/23/2000002551/
Why this matters for your vendors

A newsletter platform holds two things worth stealing at once: who its customers are and how to bill them, and the subscriber lists those customers trust it with. When one provider is breached, many senders lose control of their lists on the same day, and their subscribers become targets for phishing that looks like it comes from a name they know.

Forward this to your TPRM owner (Rescana guidance). A short, friendly check with suppliers that send email on your behalf or hold your customers’ contact data:

Do you, or any agency or contractor working for you, send newsletters or announcements through Blastmail or another hosted email service?
If you use Blastmail, has Rakus Light Cloud told you whether your subscriber lists are among the confirmed leaks, and have you decided on PPC and subscriber notifications?
What do your staff and customers know about phishing that uses your name and account details, and how will you tell them about this incident while Blastmail is down?
Can you keep sending without this provider, and where is your master copy of the subscriber list?
Which API keys or credentials connect your systems to the email service, and when will you rotate them?

Want a clear, evidence-based view of which suppliers rely on the same email and newsletter providers? Book a demo.