Yamato confirmed a leak of customer and delivery records. For online stores, the next check is where names, addresses and order details go after checkout.
Your customer's address leaves your website when you send an order to a delivery or payment partner. You need to know what happens to it there.
On 16 October 2026, Japan's Yamato Transport confirmed that attackers had taken information from its service that lets online shoppers pay after receiving goods. The notice lists about 5.26 million customer records and 50,000 delivery-recipient records, plus roughly 4,100 merchant records. Records are not necessarily unique people.
The exposed information included names, addresses, phone numbers and product details. Some records contained email addresses. Yamato said credit card details and passwords were not included.
The company detected unauthorised access on 28 September, before publishing these findings on 16 October. Kyodo's report, published the same day as the findings, says the suspended service resumed on 9 October.
Yamato said it had not confirmed secondary harm from misuse of the stolen information at the time of its notice. That does not make the exposed details harmless. A message naming a real purchase could look convincing to its recipient.
For an online store, this is a reason to review the information shared with outside services. It does not establish that your own provider has been breached.
Take one completed order and ask your developer to trace it. Which services received the customer's name, phone number, address and purchase details? Which copies remain in exports or support tools?
Check whether each partner needs every field you send. A delivery integration may need an address and contact number; unrelated customer notes should stay out unless they serve a defined purpose.
Ask providers how long they keep order data, how access is restricted, and how they will notify you about an incident. Request a named contact rather than relying only on a support inbox.
Alongside your account and website security checks, document these data flows. Start with the partners receiving the most customer information. Assign someone to review what they receive and what can stop being sent.
0 comments
Loading comments...