What happened. YMIRLINK, the Tokyo company listed on the TSE Growth market (4372) that runs the Cuenote email marketing products, filed a first report on Oct 19. Staff found unauthorized access on some Cuenote FC email delivery servers in the early hours of Friday, Oct 16, Japan time. Per the access logs, the attacker (1) used a vulnerability in a program to (2) get the credentials YMIRLINK’s own support and quality-control staff use to sign in to the service, (3) planted a malicious program that exported data from the database, and (4) used those staff credentials to try signing in to other systems.
How big. Five systems, all on the Cuenote FC dedicated ASP plan, had data accessed and exported. YMIRLINK estimates about 9 million records in total, a cumulative count that includes email addresses. What other fields were in those records is still under investigation. Which customers run those five systems, and how many individual people are affected: Undisclosed. Which vulnerability was used: Undisclosed.
What’s been done. YMIRLINK cut the affected servers off the network, built and applied a fix for the vulnerable program, deleted the support and QA staff credentials from other systems, and set up detection for malicious programs. It has reported the incident to investigators and is bringing in outside experts. It says the hit to its fiscal year ending December 2026 is still being assessed, per its TDnet filing.
Why a security team should care. This is the same pattern as this month’s ConnectWise backup incident: the attacker didn’t phish the customer, it went after the vendor’s own privileged access into customer environments. An email delivery platform holds your subscriber and customer lists, and the vendor’s support accounts sit inside it. The step that should worry buyers is the fourth one: the stolen support logins were tried on other systems. Japan’s breach run this month (Nikkei, Sourcenext, Burger King Japan) already has CISOs there reviewing suppliers, and email platforms belong on that list.
What we’d check. List every SaaS vendor with standing support or admin access to your tenant, and find out whether that access needs MFA, is time-boxed and shows up in your own logs. Ask your email platform vendor directly whether support staff credentials work across customer environments. If you use Cuenote FC, ask YMIRLINK whether your system is one of the five, then rotate API keys and SMTP credentials tied to the service and watch for phishing that uses your own subscriber list.