Yumelink Confirms 47.86 Million Records Leaked in Breach

How the attack worked

According to Yumelink, the attacker exploited a system vulnerability to plant a malicious program on a server and reach the database. The attacker also stole session information showing users were logged in, then impersonated legitimate users to take data out through the admin console. The company detected the intrusion on October 16 and has been patching the vulnerability and removing the malicious code. Separately, on October 26 it said 190 records in its customer management system Cuenote BASE, including contract company names, names, phone numbers and email addresses, had been viewable from outside.

Fallout for customers

Several client companies have disclosed their own leaks since late October. Cosmetics review site @cosme operator istyle announced on November 9 that information on about 2.8 million customers was exposed. On November 5, JR Central and two other companies said roughly 170,000 member records had leaked from the Smart EX and Express Reservation bullet train booking services.

All services except some Cuenote FC systems and Cuenote BASE are currently running normally. To prevent a repeat, Yumelink plans to introduce AI-assisted source code review and round-the-clock monitoring. It will publish the results again after an external specialist body completes its final investigation.