Shippio confirms customer-data access, document downloads and unauthorized API credentials
Shippio confirms access to all customers’ company/contact records and about 1,300 document downloads. Attackers used credentials stored in an internal tool, created unauthorized accounts/API credentials across about 1,100 teams and uploaded malicious files. Service remains paused; users must verify exports and renew API access after reopening.
- Disclosed
- Nov 4, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Shippio Platform customers and invited users; shipment, document and internal-file exposure varies by category.
- Shippio · SaaS · credentials
- In the wild
- Yes
- Shippio confirms intrusion, document downloads and unauthorized account/API credentials.
What happened
Shippio says an internal business tool was accessed from October 30 and stored credentials were used to reach Shippio Platform. Its public November 4 notice describes repeated platform access between approximately November 1 19:30 and November 2 17:00 Japan time. Detection and the service pause occurred on November 2; that pause is not evidence that the entire intrusion window ended immediately. All known routes are now blocked, according to the company. It has not named the internal tool, a CVE or a fixed customer software version; no connection to other recent SaaS incidents is established.
Company names, team names, phone numbers and addresses were viewed for all customers. Shipment information and document filenames/types were viewed for almost all customers that had registered shipments. Approximately 1,300 document files were downloaded, with their details still being investigated. Some internal shared files were viewed or taken and may contain customer information; other internal documents contained non-user personal information whose scope remains under investigation. User names/emails were accessible, but bulk acquisition has not been observed. Shippio says platform login passwords were held by an external authentication provider, not stored in its own systems, and were not acquired in this incident. These categories must not be collapsed into one confirmed-person total.
The company confirms unauthorized user accounts and API credentials affecting approximately 1,100 contracted teams, settings writes and malicious shipment-file uploads. It reports no evidence customers downloaded those malicious files and no confirmed rewriting of shipment business data. It removed unauthorized accounts/credentials and malicious files, restored changed settings, disabled the internal tool and changed or invalidated related credentials. It reset all login states; further environment/data-access validation and regulatory reporting/consultation remain in progress. No misuse of leaked information has been confirmed, which is not proof none occurred.
L4 reflects confirmed broad customer-data access and attacker-controlled accounts/API credentials in a shared logistics platform. The company remains in maintenance mode without a reopening deadline. Customer notices began November 2; the public article is dated November 4. No financial-loss figure or complete recovery is established.
Crime-scene timeline
Oct 30, 2026
Unauthorized access to an internal business tool begins
Shippio says credentials stored in that tool were subsequently used to access its systems; the detailed root cause remains under investigation.
Nov 1, 10:30 UTC
First reported platform-intrusion window begins
The vendor gives approximately November 1 19:30 to November 2 17:00 Japan time, equivalent to November 1 10:30 through November 2 08:00 UTC, with repeated access.
Nov 2, 01:40 UTC
Platform enters maintenance mode after detection
The vendor gives 10:40 Japan time; it blocks known routes, changes credentials and investigates restoration. This service pause does not establish that all unauthorized access ended at that time.
Nov 4, 2026
Public notice confirms exposure and response steps
Findings are stated as of November 3 18:00, without repeating an explicit timezone for that cutoff. The notice confirms record access, about 1,300 downloads and account/API-credential changes affecting about 1,100 teams. Reopening remains undated.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Shippio original November 4 incident noticePrimaryFull Japanese original read through a normal public HTTP request after the web reader failed. Confirms category-specific exposure, unauthorized accounts/API credentials, malicious uploads, containment and customer recovery instructions; reopening and detailed root cause remain pending.