PickGo supplier intrusion exposes 7NOW and Demae-can delivery records

CBcloud detected unauthorized access to PickGo’s business service on November 1 and published its first notice on November 2. It disabled misused accounts, blocked attacker communication and fixed the exploited defect, without identifying a CVE or entry mechanism. Broader customer/partner-driver leakage is possible and still being scoped; the company says it found no malware contamination.

Seven-Eleven Japan’s November 3 notice confirms 7NOW recipient data was acquired: 164,180 records containing kana names, 4,762 with kana names and addresses, and 209 with names, addresses, phone numbers and postcodes. The notice does not establish whether categories overlap or provide a deduplicated person count, so no combined total is claimed. Some order dates, store names/addresses and item names were also obtained. Seven-Eleven says card data and login IDs/passwords were not leaked, and its authentication information/integration settings were not found exposed or altered.

7NOW continues to operate normally; this is a supplier incident, not confirmed intrusion into Seven-Eleven’s own systems. No secondary misuse was confirmed at the notice date. Seven-Eleven says it reported the matter to Japan’s Personal Information Protection Commission and will notify affected recipients by SMS. CBcloud’s wider restrictions do not mean every delivery service is offline. The confirmed large record exposure supports L4.

Demae-can update: Its November 3 original confirms 799 recipient-name records, 794 addresses through street number, and 33 phone/postcode records; these are field categories, not an additive or unique-person total. Some store names, store addresses/phones, order notes, item names and fee details were also acquired. It excludes credit-card data and login IDs/passwords, reports no identified exposure/alteration of its authentication or integration configuration, and no confirmed secondary misuse. It reported to Japan’s Personal Information Protection Commission and will notify registered emails. Its CBcloud connection was paused and restored on November 2 after defect-fix confirmation and communication checks; no timezone is supplied for the hours. These figures are separate from 7NOW and cannot establish supplier-wide totals or intrusion into either customer’s own systems.