# Nine million was a mail-vendor estimate

2026-10-19

Ymil Link says a vulnerability on some Cuenote FC servers let a third party take credentials and then take data out. Its own estimate is about 9 million email-address rows, including duplicates. DNP’s honto list is a tenant. The vendor is the file.

Canonical: https://www.fabiocti.com/notes/nine-million-was-a-mail-vendor-estimate/
Author: Fabio Correia

Another mail switchboard. This one put a number on the output.

Ymil Link said today that some of its systems were reached from outside, that a program flaw gave up authentication information, and that personal information left. Asahi’s reading of the notice: the company’s own estimate is about 9 million rows with email addresses, a running total that can count the same person twice. That is an output estimate, not a confirmed unique-person count. Cards are not the product.

The tenants then start. DNP said the honto bookstore list that sat on Cuenote is in scope and is still being counted. Others will follow. Those letters are rooms. They are not a second incident, and they are not nine million each.

## What 9 million will be asked to cover

It will be briefed as every Japanese inbox. It is this vendor’s estimate of what left some of its servers. A list that never sat on Cuenote is out. A list that did is in the estimate until the tenant subtracts. Blastmail, when it lands, is a different vendor. Do not add the two ceilings.

If a sender mailed you, the fields they listed are the incident. If they have not written, you are in the estimate. Do not click a “confirm your newsletter” that arrives first. The vendor’s number will move. Treat the email as exposed until a tenant takes you off their letter.

Nine million is a running output. Keep the word estimate in the sentence.