Key takeaways
- Sagawa Express (佐川急便), one of Japan's largest parcel delivery companies, said on October 1, 2026 that personal data may have leaked after attackers broke into its online parcel tracking service.
- The data at risk includes the names, addresses and phone numbers of senders and recipients of parcels handled over about 100 days up to September 30, details of contract customers, and members of its Smart Club web service.
- Credit card data and passwords are not included, according to Sagawa. It has not yet said how many people are affected.
- Nine web services, including tracking and its API, are suspended. Pickup and delivery continue as normal.
What happened#
Sagawa confirmed unauthorized access to its parcel inquiry service, the web page customers use to track shipments, on September 30. Its first notice that day said only that access to the service had been partly restricted. A second notice on October 1 said the investigation had found that customer data may have been leaked.
| Date (2026) | Event |
|---|---|
| Sep 30 | Sagawa confirms unauthorized access to its parcel tracking service and restricts access. First notice |
| Oct 1 | Second notice: personal data may have leaked. Nine web services suspended |
Sagawa says it is still investigating the number of people affected, the scope and the cause.
What may have been exposed#
| Who | Data |
|---|---|
| Senders and recipients of parcels handled by Sagawa, for about 100 days up to Sep 30 | Name (company name and contact name for businesses), address, phone number |
| Companies and individuals with freight contracts | Name, address, phone number |
| Smart Club members | Name, address, phone number, email address, member ID |
Not included, according to Sagawa: credit card data and passwords.
The first group is the broadest. Anyone who sent or received a Sagawa parcel in roughly the last three months, including people who have never used Sagawa's website, may be included.
Services suspended#
Sagawa has suspended nine web services while it investigates, including:
- Online parcel tracking and the tracking API used by businesses
- Online pickup requests for its Hikyaku delivery services
- Delivery location changes, before delivery and after a missed delivery
- Product return and refund collection services
Parcel pickup and delivery continue as normal.
What we don't know yet#
Sagawa has not said:
- How many people are affected
- How the attackers got in, and when the access began
- Whether data was actually taken or only possibly accessed
- Whether it has reported the incident to the police or the Personal Information Protection Commission. Neither notice mentions it
- When the suspended services, including the tracking API, will be back
Our analysis#
A gift to delivery scammers#
Fake delivery notices are one of the most common scams in Japan. For years, text messages pretending to be from Sagawa and other carriers, claiming a missed delivery and linking to a fake site, have been used to steal credentials and spread malware. Sagawa's own notice warns about fake emails, texts and calls.
Until now, most of those messages were sent at random. Data from this breach could change that. A scammer who knows who sent a parcel to whom, and to which address, can write a message that matches a real delivery. That makes the next wave of scam messages much harder to spot. For readers, the practical advice is simple: do not follow links in delivery messages. Check the status on the carrier's own website or app, once it is back, or with the sender.
Fast notices, few answers so far#
Sagawa disclosed the intrusion the same day it confirmed it, and said the next day that personal data may have leaked. That is quick by Japanese standards. But the notices are thin. They do not give a number, a cause, or whether the police and the regulator have been told. The notice directs inquiries to "your nearest branch", although ANN reports that a dedicated inquiry line has since been opened. With about 100 days of parcels involved, a clearer picture of scale is the next thing customers and businesses need.
Not the first time#
In October 2025, Sagawa reported that attackers had logged in to Smart Club accounts using IDs and passwords apparently stolen elsewhere, and it then made two-step verification mandatory. That incident and this one are different in kind: the earlier one used reused passwords, while this one is an intrusion into the tracking service itself. But both involve the same customer-facing web services, and Smart Club member data is again on the list.
Japan's big three carriers, in one week#
Sagawa is not the only major carrier to report unauthorized access in the past week:
| Carrier | Announced | What happened |
|---|---|---|
| Yamato Transport | Sep 29 | Unauthorized access to Kuroneko Daikin Atobarai, its buy-now-pay-later service for online shopping, confirmed on Sep 28. The service was stopped that night. Whether data leaked is still under investigation |
| Japan Post | Sep 29 | Unauthorized access to the Post Office app and its Yu ID accounts. 69 records on 19 people were obtained, including shipping labels with tracking numbers and item names. Separate from its international mail inquiry incident |
| Sagawa Express | Sep 30, Oct 1 | Unauthorized access to the parcel tracking service. Sender and recipient data for about 100 days may have leaked |
The three incidents hit different services, and none of the companies has suggested any connection between them. None has said how the attackers got in. But together they mean that Japan's three largest parcel carriers all had customer-facing web services broken into within a few days of each other, and two of them involved shipping data: who sent what to whom.
The wider week has been heavy too, with Times Car, Seicomart and Tokyo Metro also disclosing incidents involving customer data.
What this means for readers#
- If you sent or received a Sagawa parcel since about late June 2026, assume your name, address and phone number may be included.
- Do not trust delivery messages, especially texts with links, claiming to be from Sagawa or any carrier. Sagawa asks customers not to open links or enter personal details in suspicious messages.
- If your business uses Sagawa's tracking API, expect it to be unavailable for now, and prepare customers for delays in tracking updates.
- If you are a Smart Club member, change your password if you have used it elsewhere, even though Sagawa says passwords were not included.
Japanese terms at a glance#
| Japanese | Reading | Meaning |
|---|---|---|
| 佐川急便 | Sagawa Kyūbin | Sagawa Express Co., Ltd. |
| お荷物問い合わせサービス | o-nimotsu toiawase sābisu | Parcel inquiry (tracking) service |
| 送り主・お届け先 | okurinushi / otodokesaki | Sender / recipient |
| スマートクラブ | Sumāto Kurabu | Smart Club, Sagawa's web service for customers |
| 飛脚宅配便 | Hikyaku Takuhaibin | Sagawa's standard parcel delivery service |
| 不審なSMS | fushin na esu-emu-esu | Suspicious text message |
We will update this article when Sagawa publishes the number of people affected and the cause.