Key takeaways
- On September 25, 2026, Japan Post found possible unauthorized access to the server behind its online inquiry service for international mail (調査請求Web受付サービス).
- The service is a pilot running only at post offices in Kanagawa and Yamanashi prefectures. It has been suspended, with no restart date.
- On October 16, Japan Post confirmed the server was breached. The details of about 600 inquiries were viewable by a third party, including the names, addresses and phone numbers of senders and recipients, many of them presumably overseas. It has not confirmed that anyone viewed them.
- The service's email account was also used to send spam. Japan Post asks anyone who received unexpected mail from kokusai-web-chousa@mail.post.japanpost.jp to delete it without opening links or attachments.
Update, October 19: Japan Post's second notice, on October 16, says about 600 customers' details were exposed and that the service's mail account sent spam. See The October 16 notice.
What happened#
Japan Post published a short notice on September 25. According to the notice:
- At around 15:00 JST that day, Japan Post found that the server used by its international mail inquiry web service may have been accessed from outside without authorization.
- The cause and the extent of the impact are under investigation.
- The service has been temporarily suspended. Japan Post will announce a restart on its website.
The notice's title refers to "unauthorized access, etc." (不正アクセス等), which leaves open whether other kinds of incidents are involved. It gives no further detail.
The October 16 notice#
Added October 19, 2026.
Three weeks after the first notice, Japan Post published what its investigation had found:
| What happened | The service's server was accessed without authorization. Customer information registered when filing inquiries was in a state where a third party could view it |
| How many | About 600 inquiries |
| Senders | Name, address, phone number, email address |
| Recipients | Name, address, and, if the customer entered them, phone number and email address |
| The item | Tracking number, mail type and fee, the post office it was sent from, and other details |
| Viewed? | Not confirmed either way. No sign of misuse so far |
| Spam | Spam was sent from the email account the service uses. Japan Post says the registered customer data was not used as recipients |
| Next | Affected customers will be contacted "once preparations are complete" |
The spam explains the "etc." in the title of both notices. Japan Post says it stopped using the address, kokusai-web-chousa@mail.post.japanpost.jp, once it detected the access, and asks anyone who received unexpected mail from it to delete it without opening attachments or links.
The notice does not say how the attacker got in, when the access began, or whether the service will return.
What the service does#
The inquiry service lets customers ask Japan Post to trace international mail that has not arrived, arrived damaged, is missing contents, or is delayed. Customers can file the request online instead of filling in a paper form at a post office counter.
According to trade press reports:
- The service started as a pilot in February 2026, limited to post offices in Kanagawa and Yamanashi prefectures, excluding small contracted branches.
- It covers EMS, registered mail, small packets, printed matter, international air parcels and international parcels.
- Customers link shipping records from Japan Post's International Mail My Page service and enter the item's tracking number to file a request.
Paper inquiries at post office counters are still available while the web service is down.
What we don't know yet#
Japan Post has not said:
- Whether the exposed data was actually viewed or taken
- How the access was detected, how the attacker got in, and when it began
- How many spam emails were sent, to whom, and what they said
- Whether the linked My Page service is affected
- Whether the service will resume
Update, October 19: Our earlier note that the data could include recipients overseas is now confirmed in part: recipients' names, addresses and phone numbers were among the exposed details. Japan Post does not say how many recipients were abroad, but every inquiry concerns international mail.
Our analysis: the notice explains the outage, not the exposure#
Japan Post announced the problem on the same day it found it. That speed is natural here. The service had to be taken offline, and customers who try to use it need to know why. In Japan, notices about a service being stopped tend to come out quickly. Notices about data being exposed usually take much longer, because organizations wait until they can say whose data was affected.
We saw that pattern in the Digital Agency breach. The agency went public eleven weeks after detection, once it had identified the people affected.
So the real test for Japan Post is the follow-up. The questions that matter are:
- Did anyone actually get into the server?
- What customer data did it hold?
- Were the linked shipping records exposed?
- What should customers watch for?
"Under investigation" is a reasonable first answer. The question is how long it remains the only one. We will be watching for that follow-up.
Update, October 19: The follow-up came three weeks later, and answers most of these questions: the server was breached, about 600 customers' details were viewable, and the linked data included recipients. It still does not say how the attacker got in. The spam is a useful reminder for anyone reading a Japanese breach notice: "unauthorized access, etc." (不正アクセス等) is often where a second problem is hiding, here an email account turned into a spam sender.
What this means for readers#
- If you used the service, or sent international mail from Kanagawa or Yamanashi and filed an online inquiry, watch for a follow-up notice from Japan Post. Be wary of unexpected messages about your parcels. Japan Post's name is already one of the most common lures in phishing texts in Japan.
- If you received international mail from Japan and the sender filed an online inquiry about it, your name, address and possibly phone number may have been exposed. Japan Post is contacting the customers who filed inquiries; it has not said it will contact recipients.
- Delete unexpected mail from kokusai-web-chousa@mail.post.japanpost.jp without opening links or attachments.
Japanese terms at a glance#
| Japanese | Reading | Meaning |
|---|---|---|
| 調査請求 | chōsa seikyū | Inquiry (trace) request for lost, damaged or delayed mail |
| 不正アクセス等 | fusei akusesu tō | "Unauthorized access, etc." |
| 原因および影響範囲については、現在調査中 | gen'in oyobi eikyō han'i ni tsuite wa, genzai chōsa-chū | "The cause and scope of impact are under investigation" |
| 一時的に受付を停止 | ichijiteki ni uketsuke o teishi | Temporarily suspended |
We will update this article if Japan Post publishes more.