{
  "id": "openlogi-shipping-data",
  "url": "https://ohshit.app/incidents/openlogi-shipping-data/",
  "title": "OPENLOGI confirms theft of shipping records from its logistics platform",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-11",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "OPENLOGI",
    "logistics",
    "data breach"
  ],
  "ecosystems": [],
  "summary": "OPENLOGI confirmed that an intruder took shipment records containing recipient and product details. The company blocked the known access route on November 9. The total affected count is still under investigation.",
  "splash": "Recipients of some shipments requested through OPENLOGI from April 8 through November 8, 2026.",
  "wipe": "Verify delivery messages through the seller or carrier. Merchants should reconcile shipment records with OPENLOGI.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify delivery messages independently",
      "hint": "Use the order page or an established carrier channel to verify tracking, address changes and delivery fees. Ignore unsolicited links and attachments, and avoid providing credentials, personal details or payment in response."
    },
    {
      "title": "Reconcile affected shipments with the provider",
      "hint": "If you use OPENLOGI, ask for your affected shipment IDs and fields. Compare them with shipments requested from April 8 through November 8, preserve relevant exports and access logs, and warn potentially affected recipients about delivery impersonation through established channels. Follow up with individual scope once confirmed."
    },
    {
      "title": "Review account access after the reset",
      "hint": "For merchant accounts, verify expected active users and sessions, and check shipment exports or address changes around November 8–9. Report unexplained activity to OPENLOGI at cs@openlogi.com, as listed in its notice."
    }
  ],
  "sources": [
    {
      "name": "OPENLOGI incident notice",
      "url": "https://corp.openlogi.com/news/notice/notice-20261111/",
      "says": "Confirms extraction, the shipment window, data fields, containment and continued warehouse operations.",
      "primary": true
    },
    {
      "name": "HUMAN MADE issuer disclosure",
      "url": "https://tdnet-pdf.kabutan.jp/20261111/140120261111574129.pdf",
      "says": "Identifies potentially affected CURRY UP records and reports access restrictions and the session reset.",
      "primary": true
    },
    {
      "name": "SKIYAKI customer notice",
      "url": "https://skiyaki.com/contents/1126864",
      "says": "Confirms its use of OPENLOGI for some Bitfan fulfillment and says it is checking its own scope.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "OPENLOGI confirms unauthorized access and extraction of shipping data.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 8, 2026",
      "title": "Unauthorized access begins",
      "body": "OPENLOGI dates the intrusion to November 8–9."
    },
    {
      "date": "Nov 9, 2026",
      "title": "OPENLOGI blocks the known access route",
      "body": "The company says it detected no further unauthorized access after the block."
    },
    {
      "date": "Nov 11, 2026",
      "title": "OPENLOGI and merchants disclose the incident",
      "body": "The provider confirms data extraction. HUMAN MADE identifies its CURRY UP shipping records as potentially affected. SKIYAKI is checking Bitfan records."
    }
  ],
  "body_markdown": "OPENLOGI says the extracted records include recipient names, addresses, phone numbers, email addresses where registered, and product details such as names and quantities. OPENLOGI does not store credit card numbers. The shipment request window identifies records under investigation. The provider has not published the number of affected records or people.\n\nHUMAN MADE says OPENLOGI blocked the attack source, restricted access from outside Japan and reset login sessions for all users. HUMAN MADE identifies only its CURRY UP brand as potentially affected and reports no unauthorized access to its own systems. SKIYAKI says some Bitfan shipping data it provided may be involved. The provider reported no known misuse as of November 11. Warehouse receipt and dispatch continued as usual, with some system operations affected by emergency maintenance. External specialists are investigating the entry route and scope."
}