Summary
- Environment: blastmail API servers, sales-management database and service database
- Operational impact: Data theft and a service suspension beginning October 21
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 24, 2026; updated as evidence emerges.
What happened
Impact
The October 21 second report said information for all contracted customers was involved, including company and contact names, telephone numbers, email and billing email addresses, and contract or payment histories. The company said it did not hold credit-card numbers. [1]
Some customers’ recipient lists and email-delivery data were also leaked; the detailed scope remained under investigation. The notice did not give a verified numeric customer total. [1]
Timeline
Service suspended and second report issued
blastmail was stopped at 00:30 Japan Standard Time. The second report described data theft and the continuing investigation.
[1]Briefing updated
This briefing was last reviewed and updated on October 24, 2026.
Threat Group & Attack Vector
The attacker entered API servers and used them to access connected databases. The reviewed report does not identify the entry vulnerability or how the attacker first obtained access. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
RAKUS said it was investigating the entry route, checking system safety and notifying customers. The service remained stopped at the time of the October 21 second report, which did not establish a restart time. This briefing does not establish its subsequent operational status. [1]