On 16 October Yamato Transport updated the breach it first announced on 29 September: 5.31 million sets of personal information belonging to users of its deferred-payment service were compromised in an unauthorised access. The data, names, addresses and phone numbers, was gathered over roughly eight years from 1 October 2018. The same round-up lists further Japanese disclosures that week; the Japan Times covers the wider run.
A record is not a person
One outlet, reporting on the breakdown, says Yamato is counting records, not individuals: about 5.26 million buyers, around 50,000 delivery recipients and 4,100 affiliated merchants. I have only seen that split in secondary coverage, so treat it as provisional until the company's own notice says so. The point stands either way. A headline number sums rows. Someone who bought from three shops across eight years may appear three times, and a recipient who never signed up for anything may appear because somebody else sent them a parcel.
That matters for the notification work. Deduplicating is one job; reaching people with addresses that have changed since 2018 is a harder one, and the recipient who has no idea they are in a payments database is the hardest.
Why eight years?
Credit card numbers and passwords do not appear to have been involved, which is the better version of this story. But a deferred-payment service needs an order to be settled, and once it is settled the business reason to keep the name and phone number of a buyer for eight years gets thin. Records survive because deleting them is a project, and retaining them is a default.
Questions for your own payment and checkout services
- What is the oldest customer record in the service, and what rule made it stay?
- Do you hold data about people who never signed up, such as recipients, referees or beneficiaries? Who has ever told them?
- When you report an incident, can you say how many unique individuals sit behind the count? If you cannot, work that out before you need to.
- Does an auditor see your retention job run, or just the policy?
The unanswered detail here is how the data left Yamato's systems, and the company has not said much beyond working with an outside security firm. We will not guess. If you would like help with retention mapping for transactional services, our address is sales@halfteck.com.