Key takeaways
- Yamato Transport (ヤマト運輸), Japan's largest parcel delivery company, says attackers broke into Kuroneko Daikin Atobarai (クロネコ代金後払い), its buy-now-pay-later service for online shopping.
- In a second report on October 2, 2026, Yamato said data on some customers may have leaked: names, addresses, phone numbers, email addresses, billed amounts, outstanding balances and item details.
- Some merchants' names and codes, and the names of Yamato employees who handle the service, may also have leaked. Credit card data and passwords are not included.
- The service has been down since September 28, with no date for its return. Parcel delivery is not affected.
Current status#
Last checked: October 2, 2026. This is an ongoing incident, and this section will be updated as Yamato publishes more.
| Status | |
|---|---|
| Service | Suspended since Sep 28, 22:28 JST. No restoration date |
| Data | May have leaked. Scope and number of people still under investigation |
| Notification | Yamato will contact people whose data is confirmed to have leaked |
| Cause | Not disclosed |
| Other services | TA-Q-BIN parcel delivery and other services operating normally |
What happened#
Kuroneko Daikin Atobarai lets online shoppers receive goods first and pay later, at a convenience store or elsewhere, using a paper payment slip or a notice sent to their smartphone. Online shops sign up as merchants and use it as a payment option.
| Date (2026) | Event |
|---|---|
| Sep 28 | Yamato confirms unauthorized access, restricts outside access and stops the service at 22:28 |
| Sep 29 | First report published |
| Oct 2 | Second report: customer, merchant and employee information may have leaked |
Yamato is investigating with the help of an outside security firm.
What may have been exposed#
| Whose | Data |
|---|---|
| Some customers of the pay-later service | Name, address, phone number, email address, credit reference number, billed amount, outstanding balance, item details |
| Some merchants using the service | Merchant name, merchant code |
| Yamato employees handling the service | Names |
Not included, according to Yamato: credit card data and passwords.
What we don't know yet#
Yamato has not said:
- How many customers and merchants are affected
- How the attackers got in, and when the access began
- Whether data was actually taken, or only possibly accessed
- Whether it has reported the incident to the police or the Personal Information Protection Commission. Neither report mentions it
- When the service will return
Our analysis#
What you bought, and what you owe#
Most breaches expose who someone is. This one may also expose what they bought online, how much they were billed and how much they still owe. For a pay-later service, that is the core of the account.
It is also exactly what a convincing payment scam needs. A message or letter that names the real shop, the real item and the right amount, and says a payment is overdue, is far harder to dismiss than a generic phishing text. Because the service uses paper payment slips, a fake reminder could just as easily arrive by post. Yamato's own warning covers suspicious emails, texts, phone calls and postal mail.
Merchants and staff names#
The leak of merchant names and codes and the names of Yamato employees who handle the service matters for businesses. Someone posing as "Yamato's person in charge of your account" now has a real name to use when contacting a shop about payments or account changes. Online shops that use the service should confirm any such request through a known contact.
Fast notices, but the service is still down#
Yamato stopped the service within hours of confirming the intrusion, published a notice the next day, and a second report four days later. That is quick. But until the service returns, online shops that rely on it lose a payment option, and customers with outstanding balances have little information about what to do. The notices list only an email address for inquiries.
Japan's big three carriers, in one week#
Yamato is one of three major Japanese carriers to report unauthorized access within a few days, along with Japan Post and Sagawa Express. The incidents hit different services, and none of the companies has suggested a connection or said how attackers got in.
What this means for readers#
- If you have used Kuroneko Daikin Atobarai to pay for online shopping, assume your name, address, contact details and purchase details may be included. Wait for a notice from Yamato.
- Treat any payment reminder with suspicion, by email, text, phone or post, especially one that asks you to pay to a new account or follow a link. Check with the shop you bought from.
- If you run an online shop that uses the service, prepare another payment option, and verify any contact claiming to be from Yamato through a known channel.
Japanese terms at a glance#
| Japanese | Reading | Meaning |
|---|---|---|
| ヤマト運輸 | Yamato Un'yu | Yamato Transport Co., Ltd. |
| クロネコ代金後払いサービス | Kuroneko Daikin Atobarai Sābisu | Yamato's buy-now-pay-later service for online shopping |
| 与信番号 | yoshin bangō | Credit reference number |
| 債権残高 | saiken zandaka | Outstanding balance |
| 加盟店 | kameiten | Merchant (shop using the service) |
| 払込票 | haraikomihyō | Paper payment slip |
We will update this article as Yamato publishes the number of people affected, the cause and the restoration date.