Japan Post Holdings says 249 Yu ID accounts may have been viewed in unauthorized logins
In short
Japan Post Holdings (日本郵政) said on 19 October that third parties used leaked IDs and passwords to log in to its Yuyu Point (ゆうゆうポイント) site, and that data from 249 Yu ID (ゆうID) accounts may have been viewed. The site has been suspended since 16 October, and two-step authentication became mandatory for Yu ID logins from 20 October.
Read the full story 2 min read
Japan Post Holdings said on 19 October that member information in 249 accounts of its common ID service, Yu ID, may have been viewed by a third party. The company said the IDs and passwords used had leaked outside its systems. [ 1 , 2 , 4 , 5 ]
According to the company, suspicious access to the Yuyu Point official site was detected on 15 October. An investigation found that a third party had used a list of leaked IDs and passwords to impersonate members and log in. The company suspended the site from 16 October. [ 1 , 2 , 4 , 5 ]
Names, addresses, dates of birth and phone numbers may have been viewed. ITmedia and Impress Watch also list gender and email address, and workplace, family details and address book entries if the user had registered them. In one account, 83 addresses stored in the address book may have been obtained. Affected users are being contacted in turn, by phone and other means. [ 1 , 2 , 4 , 5 ]
ITmedia says Yu ID is used for requesting Yu-Pack (ゆうパック) parcel pickups and managing Yuyu Point. [ 4 ]
ITmedia and Impress Watch report that the company made two-step authentication mandatory for Yu ID logins from 20 October. The company is also asking users to reset passwords and registered email addresses and to set up passkeys. [ 2 , 4 , 5 ]
ITmedia and Impress Watch report that the IDs do not overlap with those obtained in the unauthorized access to the post office app announced on 29 September, and that no leak from the company's own systems has been confirmed. NHK's headline points to use of information leaked elsewhere. [ 3 , 4 , 5 ]
Impress Watch reports that the Yuyu Point site resumed on 20 October after maintenance, though awarding of points may take time and exchange to digital gifts remains suspended. It adds that the company warns of suspicious emails and SMS posing as Japan Post or group companies, and says neither asks for passwords or credit card numbers by phone or email. [ 5 ]
Why it matters
The company said names, addresses and other personal details may have been seen, and it is asking users to change passwords. Outlets describe the case as a login attack using ID and password lists that leaked outside the company, and the company has not confirmed a leak from its own systems.
Key facts
- Japan Post Holdings announced on 19 October that 249 accounts may have had member information viewed through unauthorized logins. [ 2 , 4 ]
- Suspicious access to the Yuyu Point official site was detected on 15 October, and the site was suspended from 16 October. [ 1 , 2 , 4 , 5 ]
- A third party impersonated members using a list of IDs and passwords that had leaked outside the company. [ 1 , 2 , 4 , 5 ]
- Information that may have been viewed includes name, address, date of birth and phone number; ITmedia and Impress Watch also list gender and email address. [ 1 , 2 , 4 , 5 ]
- In one account, 83 addresses stored in the address book may have been obtained. [ 2 , 4 , 5 ]
- Two-step authentication has been mandatory for Yu ID logins since 20 October. [ 4 , 5 ]
Confirmed by several sources
- Japan Post Holdings said 249 accounts may have been logged into without authorization and their member information viewed. [ 1 , 2 , 4 , 5 ]
- The company says the logins used IDs and passwords leaked outside its systems, and it has urged users to reset passwords. [ 1 , 2 , 4 , 5 ]
- Two-step authentication became mandatory for Yu ID logins from 20 October. [ 4 , 5 ]
- The company has found no overlap with the Yu IDs obtained in the unauthorized access to the post office app announced on 29 September, and has confirmed no leak from its own systems so far. [ 4 , 5 ]
Still unclear
- Whether the information was actually viewed. Every outlet says only that it may have been viewed.
- Where the leaked ID and password list came from. NHK's headline and ITmedia describe it as information leaked from other companies, but the other documents say only that it leaked outside.
- Whether the Yuyu Point site has reopened. Impress Watch says it resumed on 20 October after maintenance, with exchange to digital gifts still suspended; the other outlets say only that it was suspended from 16 October.
What local media are saying
Timeline, local time
- TBS NEWS DIG reported the announcement on 19 October. [ 1 ]
- Nikkei reported that the company announced the unauthorized logins on 19 October. [ 2 ]
- NHK reported the announcement on 19 October. [ 3 ]
- ITmedia reported on 20 October that two-step authentication was mandatory from that day. [ 4 ]
- Impress Watch reported on 20 October that the Yuyu Point site had resumed after maintenance. [ 5 ]