According to a report by the Nikkei Asian Review on October 22, Blastmail, a bulk email service offered by the Japanese listed software company Rakus, was illegally accessed by a third party. Attackers stole customer data from the sales management system, including company names, contact persons, phone numbers, email addresses, and contract payment records. The company suspended service early on October 21, with no restoration time specified, and the intrusion route is still under investigation.
This incident has also affected other organizations using Blastmail. JR Shikoku, the International Horticultural Exposition Association, and Japan Oil Resources Development Corporation have disclosed potential data breach risks. Rakus has also implemented a preventative service suspension for seven of its enterprise software services; however, it has not yet confirmed that these services were compromised.
This incident highlights the risks associated with the centralization of third-party cloud services: an attack on a single vendor can simultaneously impact the customer data and business operations of multiple companies, increasing the risk of targeted phishing emails and identity theft.
