---
title: "Raksul print-data submission incident"
description: "Raksul restricted print-submission services after unauthorized access involving system credentials."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-09"
canonical_url: "https://www.ally.security/incidents/raksul-print-data-submission-incident-2026"
markdown_url: "https://www.ally.security/incidents/raksul-print-data-submission-incident-2026.md"
stix_url: "https://www.ally.security/incidents/raksul-print-data-submission-incident-2026/stix.json"
---

# Raksul print-data submission incident

Raksul confirmed unauthorized access; exposure of information within customers’ print files remains under investigation.

Last modified Nov 9, 2026 · 1 source

## Summary

- **Environment:** Print-data submission processing
- **Operational impact:** Partial service suspension and possible shipping delays
- **Financial impact:** No incident cost disclosed

## What happened

[Raksul](https://corp.raksul.com/) detected unauthorized access on November 8, 2026 and suspended some print-submission services. [1](#source-1)

## Impact

- Print files, invoices and web-mailing data may have exposed contact information belonging to customers and people named in printed materials. The count remains unknown. [1](#source-1)
- Raksul said customer login IDs, passwords and card information had not leaked. [1](#source-1)
- Some services restarted November 9; Package, Adobe Express integration, design requests and the catalog site remained unavailable. Data checks and shipments could be delayed. [1](#source-1)

## Timeline

### November 8, 2026 — Access detected; services restricted

Detection occurred around 00:20, according to the [incident notice](https://corp.raksul.com/wp-content/uploads/2026/11/397b6b504e1950f3ff994945bf13c3bc.pdf). [1](#source-1)

### November 9, 2026 — Notice issued and partial reopening begins

Phased reopening began at 07:00. [1](#source-1)

### November 9, 2026 — Briefing updated

This briefing was last reviewed and updated on November 9, 2026.

## Threat Group & Attack Vector

Raksul said unlawfully obtained system credentials were used to access its submission environment. How those credentials were obtained remains undisclosed. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): abuse of system credentials. [1](#source-1)

## Response

Raksul invalidated credentials, disabled affected accounts and continued investigating. It planned a privacy-regulator report and had identified no related misuse by November 9. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/raksul-print-data-submission-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Raksul notice of unauthorized access and possible personal-information leakage

official · Raksul · Nov 9, 2026

<https://corp.raksul.com/wp-content/uploads/2026/11/397b6b504e1950f3ff994945bf13c3bc.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Unauthorized access detected and submission services restricted: 2026-11-08
2. **Resulted In · 100% confidence · current**  
   Raksul print-data submission incident: Raksul said system credentials had been unlawfully obtained and used, making some stored data externally accessible. It invalidated those credentials and disabled the accounts used for unauthorized access.
3. **Resulted In · 100% confidence · current**  
   Raksul print-data submission incident: Unauthorized access detected and submission services restricted
4. **Occurred At · 100% confidence · current**  
   Public notice and partial service restart: 2026-11-09
5. **Resulted In · 100% confidence · current**  
   Raksul print-data submission incident: Raksul said credit-card information, customer login IDs and customer passwords had not leaked. It had identified no related misuse as of the November 9 notice.
6. **Resulted In · 100% confidence · current**  
   Raksul print-data submission incident: Public notice and partial service restart
7. **Resulted In · 100% confidence · current**  
   Raksul print-data submission incident: Raksul continued investigating the cause and scope and planned to report to Japan’s Personal Information Protection Commission.
8. **Affected Organization · 100% confidence · current**  
   Raksul print-data submission incident: Raksul
9. **Resulted In · 100% confidence · current**  
   Raksul print-data submission incident: Possible exposure includes names, company names, addresses, phone numbers and email addresses in print submissions, invoices and web-mailing data. Printed materials can contain information about people other than the ordering customer. The number affected and beginning of the exposure period remain under investigation.
10. **Resulted In · 100% confidence · current**  
   Raksul print-data submission incident: Services began reopening from 07:00 on November 9, but Raksul Package, Adobe Express integration, design-production requests and the catalog site remained suspended. Data checks and shipping could be delayed.
11. **Resulted In · 100% confidence · current**  
   Raksul print-data submission incident: Raksul detected unauthorized access to its print-data submission processing system around 00:20 on November 8, 2026. It suspended some services requiring data submissions that day.
12. **Used Attack Technique · 100% confidence · current**  
   Raksul print-data submission incident: https://attack.mitre.org/techniques/T1078/
13. **Disclosed At · 100% confidence · current**  
   Raksul print-data submission incident: 2026-11-09
14. **Discovered At · 100% confidence · current**  
   Raksul print-data submission incident: 2026-11-08

</details>