Blastmail, the bulk-email service run by Rakus Lite Cloud, has been offline since 21 October and plans to restart around 11 November on a newly built environment. Our analysis of Japan's mail-delivery platform breaches covered it to 5 November. At that point, every customer's contract details were known to have been taken, and delivery data such as recipient lists had left for 421 contracts. The update of 9 November adds no new cases. It says the outside investigation should finish on 10 November and that the restart is still aimed at about 11 November. The one question that matters most for a restart is still open: how the attacker got into Blastmail's API servers. This follow-up sets out what has changed, the full timeline Rakus Lite Cloud now publishes, and what customers should check before they send again.
What is affected, and what is not
Status as of Rakus Lite Cloud's update of 9 November 2026, 13:00.
| Item | Status | What is known |
|---|---|---|
| Every customer's contract details | Affected (confirmed) | Company name, contact name, phone number, email, billing email, and contract and payment history, taken from the sales-management system. |
| Delivery data such as recipient lists | Affected for 421 contracts | 345 by 26 October; outside investigators found 76 more on 4 November. All 421 have been told individually. No new cases since the previous report. |
| Any other data | Under investigation | The outside investigation is due to end on 10 November. Rakus Lite Cloud will then report whether anything beyond contract details leaked. The date of its final report is not yet set. |
| Card numbers | Not held | Rakus Lite Cloud says it does not hold card numbers. |
| The way in | Under investigation | The attacker got into two API servers, ran commands, and connected from there to the sales-management system and the service database. How the API servers were first entered is not known. |
| Service | Stopped since 21 October | Admin screen and API since about 00:30, mail since about 01:00. The restart is aimed at about 11 November, on a newly prepared environment, and may move. The OEM version will be announced separately. |
What changed since 5 November
- No new cases. The 9 November update says no further customers have been found to be affected since the previous report. The count of contracts with delivery data taken stays at 421.
- An end date for the investigation. The outside investigation should be complete on 10 November. Rakus Lite Cloud will report afterwards whether data other than contract details leaked, and will say later when its final report is due.
- A new environment. The restart is still aimed at about 11 November, "preparing a new environment with safety in mind". Details will go to customers by email.
- Reporting closed. Applications for joint reports to the PPC closed on 5 November. Rakus Lite Cloud says it has reported to the PPC, to JIPDEC (which runs the PrivacyMark scheme) and to the Kanto Bureau of Telecommunications, and has notified the Tokyo Metropolitan Police.
- Detail we had not reported. The notice's timeline shows that Rakus Lite Cloud stopped its own system emails, including password resets, at 22:39 on 20 October, before cutting the service off overnight. It finished blocking the servers' outbound traffic at 04:44 on 21 October.
Figure 1. Original graphic built from Rakus Lite Cloud's Blastmail notice as updated on 9 November. Times are Japan time.
Before you send again: what to check
A restart is when customers are most likely to rush. These checks are our recommendations, not Rakus Lite Cloud's.
- Read the 10 November report first. It should say whether anything beyond contract details and delivery lists left, such as message bodies or sender settings. That changes what else you need to replace.
- Ask what is new in the new environment. Ask how the API servers were entered, whether that route is closed, and whether the credentials and signing keys used for sending were replaced. Keep the answers in writing.
- Replace your own secrets. Change the admin password and the API keys your systems use, and update every connected tool, such as a CMS or CRM, before scheduled sends resume.
- Check your sender authentication. Confirm your SPF and DKIM records match what the new environment needs. If Blastmail issues new DKIM keys, publish them before your first send. If you have left Blastmail, remove its entries from your DNS.
- Warn your subscribers if your lists were taken. If you are one of the 421, send your subscribers a short notice from your own domain before you restart campaigns, so a fake message in your name meets someone who has been warned.
- Treat payment requests as suspect. Contact names, billing emails and payment history are exactly what an invoice fraudster needs. Confirm any change of bank details or "overdue payment" by phone, using a number you already hold.
The attacker's view
| Step | ATT&CK | What Rakus Lite Cloud describes |
|---|---|---|
| Get into the API servers | Route not disclosed | Two API servers entered; how is under investigation. |
| Run commands | T1059 Command and Scripting Interpreter | Commands run on both API servers. |
| Reach the business systems | T1213 Data from Information Repositories | From the API servers to the sales-management system and the service database. |
| Take the data | TA0010 Exfiltration | Every customer's contract details; delivery data for 421 contracts. |
| Use it next | T1656 Impersonation | A risk, not something reported: billing contacts and payment history suit invoice fraud. |
What remains unknown
- How the API servers were entered, and whether the same route exists in the new environment.
- Whether anything else leaked, due to be reported after the investigation ends on 10 November.
- When the final report will be published.
- Whether the restart holds at about 11 November, and when the OEM version returns.
Arara Message, the other platform still offline, is covered in a separate follow-up on Arara.
Sources and updates
- Rakus Lite Cloud: Blastmail emergency stop and data leak, updated 9 November 2026, 13:00 (Japanese)
- and secure: Blastmail's 4 November update, 421 contracts (Japanese), 4 November 2026
- Rakus: Blastmail second report (Japanese), 21 October 2026
- ITmedia NEWS: every customer's details leaked; API servers (Japanese), 23 October 2026
- Nikkei: Rakus subsidiary's contract data leaked (Japanese)
- MITRE ATT&CK: T1059 · T1213 · TA0010 · T1656 Impersonation
9 November 2026: first published, as a follow-up to our 3 November analysis. We read Rakus Lite Cloud's notice directly. Its 9 November items, the investigation end date and the new environment, had not yet been reported elsewhere when we published, so they rest on the operator's page alone. The earlier figures were checked against and secure, ITmedia NEWS and Nikkei. We will update this follow-up after the 10 November report and the restart.