---
title: "blastmail API-server data theft"
description: "RAKUS disclosed data theft through two blastmail API servers and a precautionary service suspension."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-24"
canonical_url: "https://www.ally.security/incidents/blastmail-api-server-data-theft-2026"
markdown_url: "https://www.ally.security/incidents/blastmail-api-server-data-theft-2026.md"
stix_url: "https://www.ally.security/incidents/blastmail-api-server-data-theft-2026/stix.json"
---

# blastmail API-server data theft

An attacker used blastmail API servers to reach connected databases and copy customer and mailing information.

Last modified Oct 24, 2026 · 1 source

## Summary

- **Environment:** blastmail API servers, sales-management database and service database
- **Operational impact:** Data theft and a service suspension beginning October 21
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[RAKUS](https://www.rakus.co.jp/) said an external party entered two API servers used by its subsidiary RAKUS Light Cloud’s blastmail email-delivery service. The attacker executed commands and reached connected sales-management and service databases, taking information. [1](#source-1)

## Impact

The [October 21 second report](https://www.rakus.co.jp/news/2026/1021-3.html) said information for all contracted customers was involved, including company and contact names, telephone numbers, email and billing email addresses, and contract or payment histories. The company said it did not hold credit-card numbers. [1](#source-1)

Some customers’ recipient lists and email-delivery data were also leaked; the detailed scope remained under investigation. The notice did not give a verified numeric customer total. [1](#source-1)

## Timeline

### October 21, 2026 — Service suspended and second report issued

blastmail was stopped at 00:30 Japan Standard Time. The [second report](https://www.rakus.co.jp/news/2026/1021-3.html) described data theft and the continuing investigation. [1](#source-1)

### October 24, 2026 — Briefing updated

This briefing was last reviewed and updated on October 24, 2026.

## Threat Group & Attack Vector

The attacker entered API servers and used them to access connected databases. The reviewed report does not identify the entry vulnerability or how the attacker first obtained access. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

RAKUS said it was investigating the entry route, checking system safety and notifying customers. The service remained stopped at the time of the October 21 second report, which did not establish a restart time. This briefing does not establish its subsequent operational status. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/blastmail-api-server-data-theft-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### 【第2報】当社子会社が提供する「ブラストメール」における不正アクセスによる情報漏えいおよびサービス停止について

official · RAKUS · Oct 21, 2026

<https://www.rakus.co.jp/news/2026/1021-3.html>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Service halted and data theft disclosed: 2026-10-21
2. **Resulted In · 100% confidence · current**  
   blastmail API-server data theft: Service halted and data theft disclosed
3. **Resulted In · 100% confidence · current**  
   blastmail API-server data theft: The blastmail service was stopped from October 21 at 00:30 Japan time and remained unavailable in the second report; no restart time was set.
4. **Resulted In · 100% confidence · current**  
   blastmail API-server data theft: Information taken for all contracting customers included company and contact names, telephone numbers, email and billing-email addresses, and contract/payment history. RAKUS said the subsidiary did not hold credit-card numbers.
5. **Resulted In · 100% confidence · current**  
   blastmail API-server data theft: Recipient lists and other email-delivery information were also leaked for some customers; the detailed customer-specific scope remained under investigation.
6. **Affected Organization · 100% confidence · current**  
   blastmail API-server data theft: RAKUS Light Cloud
7. **Resulted In · 100% confidence · current**  
   blastmail API-server data theft: RAKUS confirmed that an external party entered two RAKUS Light Cloud API servers, executed commands and connected to the sales-management system and service database to take data.
8. **Resulted In · 100% confidence · current**  
   blastmail API-server data theft: RAKUS was checking system safety, investigating the entry route and notifying affected customers individually as the scope was established.
9. **Disclosed At · 100% confidence · current**  
   blastmail API-server data theft: 2026-10-21

</details>