OPENLOGI confirms theft of shipping records from its logistics platform
OPENLOGI confirmed that an intruder took shipment records containing recipient and product details. The company blocked the known access route on November 9. The total affected count is still under investigation.
- Disclosed
- Nov 11, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Recipients of some shipments requested through OPENLOGI from April 8 through November 8, 2026.
- OPENLOGI · logistics · data breach
- In the wild
- Yes
- OPENLOGI confirms unauthorized access and extraction of shipping data.
What happened
OPENLOGI says the extracted records include recipient names, addresses, phone numbers, email addresses where registered, and product details such as names and quantities. OPENLOGI does not store credit card numbers. The shipment request window identifies records under investigation. The provider has not published the number of affected records or people.
HUMAN MADE says OPENLOGI blocked the attack source, restricted access from outside Japan and reset login sessions for all users. HUMAN MADE identifies only its CURRY UP brand as potentially affected and reports no unauthorized access to its own systems. SKIYAKI says some Bitfan shipping data it provided may be involved. The provider reported no known misuse as of November 11. Warehouse receipt and dispatch continued as usual, with some system operations affected by emergency maintenance. External specialists are investigating the entry route and scope.
Crime-scene timeline
Nov 8, 2026
Unauthorized access begins
OPENLOGI dates the intrusion to November 8–9.
Nov 9, 2026
OPENLOGI blocks the known access route
The company says it detected no further unauthorized access after the block.
Nov 11, 2026
OPENLOGI and merchants disclose the incident
The provider confirms data extraction. HUMAN MADE identifies its CURRY UP shipping records as potentially affected. SKIYAKI is checking Bitfan records.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- OPENLOGI incident noticePrimaryConfirms extraction, the shipment window, data fields, containment and continued warehouse operations.
- HUMAN MADE issuer disclosurePrimaryIdentifies potentially affected CURRY UP records and reports access restrictions and the session reset.
- SKIYAKI customer noticePrimaryConfirms its use of OPENLOGI for some Bitfan fulfillment and says it is checking its own scope.