SHINDO3

Smart Club

Sagawa Express Co., Ltd.

Members~70,000people

POSSIBLE LEAKFull name / Shipping label / deliveryMisconfiguration · Contained

Open in the live monitor ▶
Disclosed
Jul 18, 2026
Detected
Jul 15, 2026
Detection to disclosure
3 days
Leak
Leak possible
Type
Misconfiguration
Status
Contained
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityFull name
ContactEmail address
Transactions & activityTracking (waybill) number

How many

  • Members ~70,000 people

Who is affected

  • Smart Club members

Cause

During recovery work on a Smart Club system fault, an error was introduced into the settings for delivery-schedule notification emails (not a cyberattack)

Timeline

  1. Found that delivery notice emails showed other users' details (evening)
  2. First disclosure

Response

  • Config review

System restored and recurrence-prevention measures put in place

What you should do

  1. Don't open links in emails from this company. The apology email itself may be fake
  2. Check the company's notice to see if you're affected

Lessons for companies

  1. Two-person review and pre-release tests for sharing and cache changes; monitor cloud config (CSPM)
  2. Never sit on a known defect. Test every change before production
  3. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  4. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources