Rakus Light CloudBlast Mail

3MediumPartly confirmedAnnounced Updated

Unauthorized access to the Blast Mail email delivery service exposed delivery data of 344 contracts. Affected customers include Piccoma, whose one-time mailing list of 1,002,404 addresses leaked, and many local governments.

This incident was imported from a dataset that compiles public announcements, and we are still checking it against the sources. Counts and causes will be updated after the check. Sources are in Japanese.

Cause
Unauthorized access, Via a vendor or service
Sector
IT, cloud & telecom
Operational impact
Some services stopped

Data involved

DataStatusCountGroupEvidence
NameLeak confirmedNot disclosed契約者の管理情報Source(opens in a new tab)
Phone numberLeak confirmedNot disclosed契約者の管理情報Source(opens in a new tab)
Email addressLeak confirmedNot disclosed契約者の管理情報Source(opens in a new tab)
NameLeak confirmedup to 253,000 people新潟日報・配信先Source(opens in a new tab)
Email addressLeak confirmedup to 253,000 people新潟日報・配信先Source(opens in a new tab)
Postal addressLeak confirmedup to 253,000 people新潟日報・配信先Source(opens in a new tab)
NamePossible leakabout 140,000 peopleHISホテル・配信先Source(opens in a new tab)
Email addressPossible leakabout 140,000 peopleHISホテル・配信先Source(opens in a new tab)
NamePossible leak6,334 records横浜市・配信先Source(opens in a new tab)
Email addressPossible leak6,334 records横浜市・配信先Source(opens in a new tab)
Email addressPossible leakup to 100,000 records東北電力フロンティア・配信先Source(opens in a new tab)
User or member IDPossible leakup to 100,000 records東北電力フロンティア・配信先Source(opens in a new tab)
NameLeak confirmedup to 16,000 records東京都農林水産振興財団・委託事業Source(opens in a new tab)
Email addressLeak confirmedup to 16,000 records東京都農林水産振興財団・委託事業Source(opens in a new tab)
NamePossible leakabout 1,700 companies金沢市消防局・配信先Source(opens in a new tab)
Email addressPossible leakabout 1,700 companies金沢市消防局・配信先Source(opens in a new tab)
Postal addressPossible leakabout 1,700 companies金沢市消防局・配信先Source(opens in a new tab)
Email addressLeak confirmedabout 80,000 records東京メトロ・イベントメールSource(opens in a new tab)
Email addressPossible leakup to 500 people47行政ジャーナルSource(opens in a new tab)
NamePossible leakNot disclosed長野県3サイトSource(opens in a new tab)
Email addressPossible leakNot disclosed長野県3サイトSource(opens in a new tab)
Postal addressPossible leakNot disclosed長野県3サイトSource(opens in a new tab)
Email addressLeak confirmed1,002,404 recordsピッコマ・メルマガ1回分の配信先Source(opens in a new tab)

Counts are the figures the organization announced. Because the same person may be counted more than once, we do not add the rows together.

What users should do

  • Watch for emails and texts pretending to be the company

General steps based on the type of data involved. Check the organization’s notice or help line to see whether you are affected.

Tools for this kind of attack

Picked from the cause of the incident: tools that help you check your own systems for the same kind of weakness, or spot the warning signs.

Vuls

Impact Reaches others
future-architect/vuls

An agentless vulnerability scanner that checks the packages installed on a server and lists the ones affected by known CVEs.

Purpose
Defense
Type
Command line
Difficulty
Intermediate
License
CopyleftGPL-3.0
Category
Vulnerability scanning
Actively updatedstars12,302Last update 2026-10-21
Read the Vuls review

Wazuh

Impact Local only
wazuh/wazuh

A free security platform (SIEM/XDR) that collects logs, configuration, and vulnerability data from agents on your endpoints and shows it all in one dashboard.

Purpose
Defense
Type
Self-hosted server
Difficulty
Advanced
License
CopyleftGPL-2.0(一部の構成要素は Apache-2.0)
Category
Vulnerability scanning / Forensics
Actively updatedstars17,410Last update 2026-10-24
Read the Wazuh review

Suricata

Impact Reaches others
OISF/suricata

An intrusion detection and prevention engine (IDS/IPS) that matches network traffic against rules and records suspicious activity as alerts.

Purpose
Defense
Type
Self-hosted server
Difficulty
Intermediate
License
CopyleftGPL-2.0
Category
Network
Actively updatedstars6,773Last update 2026-10-23
Read the Suricata review

Sources

  1. 【第2報】当社子会社が提供する「ブラストメール」における不正アクセスによる情報漏えいおよびサービス停止についてwww.rakus.co.jp · Published 2026-10-21(opens in a new tab)
  2. 湯沢市、大仙市が防災メールを停止 運営会社不正アクセスでwww.sakigake.jp · Published 2026-10-21(opens in a new tab)
  3. 静岡県焼津市、市民919人の個人情報が漏えいか 市民講座「焼津おとな俱楽部」関連、PHPの問題とは別www.chunichi.co.jp · Published 2026-10-22(opens in a new tab)
  4. 長岡市と十日町市でも配信事業関連の個人情報漏えいかwww.niigata-nippo.co.jp · Published 2026-10-22(opens in a new tab)
  5. JR四国、不正アクセスでメルマガ会員約3万人の個人情報が漏えいかwww.kochinews.co.jp · Published 2026-10-22(opens in a new tab)
  6. 茨城県移住情報配信会社に不正アクセス 氏名やメルアド、個人情報2700件漏えいかwww.47news.jp · Published 2026-10-22(opens in a new tab)
  7. 富山県就活、婚活サイト流出か 運営会社がサービス停止www.hokkoku.co.jp · Published 2026-10-23(opens in a new tab)
  8. 長野県が個人情報341件漏えいの可能性と発表 3事業の委託先に不正アクセスwww.chunichi.co.jp · Published 2026-10-22(opens in a new tab)
  9. HISホテルグループの個人情報流出の可能性www.hishotelgroup.com · Published 2026-10-22(opens in a new tab)
  10. 趣味の園芸の情報漏えい 約12万7千件www.47news.jp · Published 2026-10-23(opens in a new tab)
  11. メール配信サービスの契約者情報全て漏えい、影響先続報www.itmedia.co.jp · Published 2026-10-23(opens in a new tab)
  12. 東京都、個人情報流出最大1.6万件www.nikkei.com · Published 2026-10-23(opens in a new tab)
  13. 富山県と県文化振興財団運営サービスの漏えいの可能性www.hokkoku.co.jp · Published 2026-10-23(opens in a new tab)
  14. 金沢市消防局のメール配信サービスに不正アクセスwww.chunichi.co.jp · Published 2026-10-23(opens in a new tab)
  15. 春日井市のプレミアム付き商品券当選者情報に漏えいのおそれwww.47news.jp · Published 2026-10-23(opens in a new tab)
  16. イーブルなごや通信の不審アクセス事案に伴う影響e-able-nagoya.jp · Published 2026-10-23(opens in a new tab)
  17. 東京メトロ、メアド8万件流出 メルマガ登録の顧客www.47news.jp · Published 2026-10-23(opens in a new tab)
  18. 47行政ジャーナルで情報漏えい メアドなど最大500人分www.47news.jp · Published 2026-10-23(opens in a new tab)
  19. 株式会社ラクスライトクラウドで発生した不正アクセスに伴う個人情報漏えいの可能性についてwww.pref.nagano.lg.jp · Published 2026-10-23(opens in a new tab)
  20. 株式会社ラクスライトクラウドのメール配信システム「ブラストメール」への不正アクセスによるお客様のメールアドレス流出に関するお知らせとお詫び(第1報)jp.piccoma.com · Published 2026-10-24(opens in a new tab)
  21. 【重要】ブラストメールの緊急停止および個人情報漏えいに関するお詫びとご報告(2026年10月25日10時00分更新)info.blastmail.jp · Published 2026-10-25(opens in a new tab)