Japan's Blastmail email distribution service is still offline after an attacker broke into its systems and copied customer records, its operator Rakus Light Cloud has confirmed. In an update on 25 October, the company said information on all of its contract holders had been taken from its sales management system. Delivery data, including subscriber lists, was confirmed exposed for 344 customer contracts, and the company said it had contacted each of those customers individually.

The contract-holder records include company and contact names, telephone numbers, email addresses, billing email addresses, and contract and payment histories. Rakus Light Cloud says it does not hold credit card numbers, so card details were not part of the exposed data. The company has not said how many individual addresses were taken, and warns the figures may change as an external investigation continues.

How the attacker got in

According to the operator, the intruder entered two API servers, ran commands there, and from there reached the sales management system and the service database. How the attacker first got in has not been disclosed. Blastmail was stopped on 21 October after suspicious activity was detected, and its administration console, programming interface and mail delivery remain unavailable, with no restart date announced.

Knock-on effects

The knock-on effect has spread beyond the provider itself. Customers that used Blastmail to send newsletters and alerts have reported possible exposure of their own subscriber lists, including a newspaper, a hotel group and a power company, while some councils and a police force that used the service for disaster and safety alerts have been left without it. Organisations affected should watch for phishing messages that reuse real subscriber details, and anyone who receives an unexpected message claiming to come from a newsletter they subscribe to should check it through the sender's own website rather than clicking links in the email.

Sources: iSec News; EmailExpert.