Loading story…
Sakura Internet disclosed that attackers accessed its sales management system, potentially exposing customer contract and membership information tied to as many as 1,360,563 member accounts. The intrusion was uncovered during an investigation into a separate breach affecting the Sakura Rental Server service, where 583 accounts experienced unauthorized logins and malware was found on Sakura systems. The company said the exact number of affected accounts is still under investigation and that it has not confirmed any data exfiltration.
Sakura said passwords in the affected system were stored in hashed form and that the compromised environment did not contain credit card data. The company also stated the incident was not ransomware-related, no ransom demand was received, and no operational disruption was reported. Sakura invalidated abused credentials, removed detected malware, and notified affected customers and relevant authorities as the investigation continues.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
Sakura Internet said attackers accessed its sales management system, which stored customer contract and membership information. The company identified up to 1,360,563 member accounts as potentially impacted, though the exact number remained under investigation and no data exfiltration had been confirmed.
Sakura Internet publicly disclosed the cyber incident affecting its sales management system and said the intrusion was not tied to ransomware, no ransom demand had been made, and no operational disruption had been reported.
After uncovering the incidents, Sakura Internet said it increased monitoring across its environment and engaged outside forensic specialists to support the investigation. These additional response measures were disclosed alongside its ongoing investigation into the sales management system intrusion and related rental server breach.
Sakura Internet said it informed relevant authorities about the hack and began individually notifying affected customers whose data may have been exposed.
In response to the incidents, Sakura Internet invalidated abused credentials and removed detected malware from affected systems. The company also said the compromised system stored hashed passwords and did not contain credit card information.
During the investigation, Sakura Internet identified a separate breach affecting its Sakura Rental Server service that involved unauthorized logins to 583 accounts, access to customer-facing systems, and malware installation on Sakura systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourceteiss.co.uk
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourcesakura.ad.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
KDDI disclosed unauthorized access to an email platform it operates for itself and multiple Japanese internet service providers, warning that up to **14.22 million** email account records may have been exposed. The affected service supports KDDI and providers including **STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, and BIGLOBE**. KDDI said the intrusion was detected on June 17 and linked to exploitation of a vulnerability in third-party software used by the system, after which it blocked further access and added defensive measures. The potentially exposed data includes email addresses, passwords, and some personal information tied to active, dormant, and canceled accounts. KDDI said the password data was hashed or encrypted, but it has not publicly clarified the protection status or algorithms for all records, and the full scope of the incident remains under investigation. The company reported the breach to Japan’s **Personal Information Protection Commission** and the **Ministry of Internal Affairs and Communications**, and is coordinating customer notifications and password resets with the affected ISPs.
Jun 30, 2026
Crunchyroll disclosed that a breach at a third-party service provider exposed the email addresses of roughly **6.8 million to 7 million subscribers**. Reports said the incident affected subscriber contact data rather than payment information or passwords, with the anime streaming company indicating the compromise occurred outside its own core environment. The exposure raised phishing and account-targeting risks for a large portion of Crunchyroll’s user base, as attackers could use the leaked addresses to impersonate the company or deliver credential-harvesting messages. Coverage of the incident described it as a major supply-chain style data exposure tied to a vendor, underscoring how breaches at external partners can affect millions of customers even when a company’s internal systems are not directly penetrated.
Jul 12, 2026
KDDI disclosed that a cyberattack against an email platform it operates for five Japanese internet service providers exposed more than **12.2 million customer email addresses** and **7.6 million passwords**. The compromised system supported customer account management, webmail, and email storage, and the company said the intrusion was enabled by a vulnerability in third-party software used by the platform. KDDI initially reported the unauthorized access in June and later confirmed the scale of the breach after a forensic investigation and notification to Japan’s communications ministry. The company said it patched the flaw and modified the affected system immediately after detecting the attack, adding that investigators found no evidence of compromise beyond exploitation of the vulnerable software. KDDI also said its own consumer email services for mobile and fixed-line internet customers run on separate infrastructure and were not affected. The incident has prompted affected ISPs to coordinate mandatory password resets for impacted users and underscored the risk that a single flaw in shared third-party software can cascade across multiple providers.
Jul 9, 2026