Key points

On October 15, 2026, Japan Post detected unauthorized logins on the official "Yuu ID" point service website and announced on October 19 that information from 249 member accounts may have been viewed by third parties. The unauthorized logins involved impersonation using leaked ID and password lists obtained externally, exposing personal information such as names, addresses, and birthdates. Following this, Japan Post mandated two-factor authentication from October 20 and is urging users to change passwords and set up passkeys. [3] [4]

Unauthorized Logins Detected on Japan Post's "Yuu ID"

On October 15, 2026, Japan Post detected suspicious access on the official "Yuu ID" point service website and announced on October 19 that information from 249 member accounts may have been viewed by third parties. Investigations revealed that third parties impersonated users by using externally leaked ID and password lists. The potentially viewed information includes names, addresses, birthdates, phone numbers, email addresses, workplace information, family status, and address book details. [3] [4]

The unauthorized logins involved impersonation using leaked ID and password lists obtained externally. Japan Post is responding based on laws prohibiting unauthorized access. Among the 249 accounts, one account may have had 83 address entries from its address book illicitly obtained. Japan Post has suspended the website and continues its investigation; the date for service resumption is undecided. [4]

Past Unauthorized Access Incidents and Current Measures

On September 29, 2026, unauthorized access to the Post Office app was disclosed, revealing that information from 19 individuals across 69 records was illicitly obtained. This incident occurred and was discovered on September 25, with the service resuming on September 26. The recent unauthorized logins on "Yuu ID" follow this incident but are considered separate unauthorized access cases. Japan Post is strengthening security measures in response to these incidents. [2]

Accordingly, from October 20, 2026, Japan Post has mandated two-factor authentication for logging into "Yuu ID" and is urging users to review their passwords and set up passkeys. Two-factor authentication adds an additional identity verification step during login to reduce the risk of unauthorized access. Users are recommended to change passwords, increase complexity, and avoid reusing passwords across services. Japan Post states it will continue enhancing security measures. [1]

User Advisories and Future Plans

Japan Post has clearly stated that it will never ask for passwords or credit card numbers via phone or email and urges users to be cautious of suspicious communications. There is a risk of phishing emails or SMS messages directing users to fake websites, so users should avoid clicking on suspicious links. If suspicious contact is received, consulting the Phishing Countermeasures Council or the Personal Information Protection Commission's contact points is recommended. [4]

Users are advised to follow official guidance from Japan Post by resetting passwords, adopting passkeys, and enabling two-factor authentication. These steps help protect personal information and prevent unauthorized logins. Japan Post will continue efforts to strengthen security and create an environment where users can safely use its services. [4]