Summary
- Environment: Freight platform and internal business tools
- Operational impact: Service suspended; shipment information and documents exposed
- Financial impact: No incident cost publicly quantified
- Record status: Developing record. Reviewed November 6, 2026; updated as evidence emerges.
What happened
Impact
All customers’ company and team contact information was viewed. Shipment details and document names were viewed for nearly all customers with shipments; about 1,300 document files were downloaded. [1]
Timeline
Internal-tool access began
Internal-tool access began, as described in the incident notice.
[1]Platform suspended at 10:40 JST
Platform suspended at 10:40 JST, as described in the incident notice.
[1]Incident notice published
Incident notice published, as described in the incident notice.
[1]Briefing updated
This briefing was last reviewed and updated on November 6, 2026.
Threat Group & Attack Vector
Access to an internal business tool began October 30. Credentials stored there were used against the platform between about November 1 at 19:30 and November 2 at 17:00 JST. [1]
Unauthorized accounts and API credentials were created across about 1,100 teams, and malicious files were uploaded. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1078 — Valid Accounts. [1]
- T1136 — Create Account. [1]
Response
Shippio blocked known access paths, rotated credentials, removed unauthorized accounts and files, and restored altered settings. The November 4 notice gave no restart date; regulatory consultation and individual notifications continued. [1]
In its November 6 clarification, Shippio said it stopped the compromised internal tool around 11:40 JST on November 2 and finished blocking related unauthorized platform access at 17:38 JST that day. [1]