Sakura Internet Breach Exposes 1.36 Million Customer Records

Key Takeaways

• Japanese cloud provider Sakura Internet disclosed a breach impacting its sales management system.
• Up to 1.36 million customer accounts may have had personal data exposed.
• The incident is linked to an earlier unauthorized access event affecting Sakura Rental Server environments.
• Hashed passwords for some accounts were exposed, but credit card data was not stored in the compromised system.
• Investigations are ongoing, and the company has implemented mitigation measures and is notifying affected customers.

Sakura Internet Data Breach Affects 1.36 Million Customer Records

Japanese cloud and hosting provider Sakura Internet has revealed a security incident potentially compromising the personal information of approximately 1.36 million customer accounts. The breach involves the company’s sales management system, which stores critical customer and contract details.

The discovery of this new compromise emerged during an ongoing investigation into unauthorized access activities targeting Sakura Rental Server environments. Initially, Sakura Internet announced the rental server intrusion on August 17, 2026. Subsequent inquiries confirmed that threat actors might also have accessed a distinct system responsible for managing customer contracts and service-related data.

Reports indicate that the unauthorized access to the sales management platform occurred prior to August 9, the date when the company first detected the initial malicious activity involving its Sakura Rental Server infrastructure.

Scope of the Compromise

Sakura Internet clarified that the sales management platform operates independently from its core service delivery environments, including its Sakura Cloud offerings. Despite this separation, the platform houses sensitive member and contractual information, making any exposure a significant concern for customers utilizing its hosting and associated services.

The company estimates that 1,360,563 customer accounts could be impacted. It’s important to note that this figure represents the potential scope of affected accounts rather than a definitive count of confirmed victims. This total includes Sakura Rental Server customers who were already part of the earlier disclosure.

Information potentially accessed by attackers includes customer and member data held within the sales management system. Sakura Internet also confirmed that hashed password information for some accounts might have been exposed. While hashed passwords are transformed to prevent direct recovery, they can still pose a risk, particularly if weak or reused passwords are subjected to offline cracking attempts.

Crucially, the company stated that customer credit card information is not stored within the compromised environment. Furthermore, as of its most recent update, Sakura Internet has not confirmed any data exfiltration from its systems.

Ongoing Investigation and Mitigation

Investigators are actively working to determine precisely what information was viewed, obtained, or potentially removed by the attackers. The initial Sakura Rental Server incident affected 583 accounts through unauthorized logins. Sakura Internet said attackers gained sufficient access to enter affected customer environments and deploy malware. Personal data belonging to some rental server customers may also have been viewed or obtained during that initial intrusion.

In response, Sakura Internet has invalidated authentication credentials suspected of involvement in the unauthorized access, blocked identified attacker access paths, removed malware, and enhanced monitoring across its relevant systems. The provider has also engaged an external forensic organization to conduct a thorough investigation, pinpoint the attack vector, and establish whether the compromise of the sales management system is connected to the earlier rental server breach.

The company is in the process of notifying affected customers individually and sharing information with relevant organizations. Sakura Internet plans to release further updates as additional facts requiring disclosure become available.

What You Should Do

• Change Passwords: Immediately update your Sakura Internet password to a strong, unique one.
• Enable Multi-Factor Authentication (MFA): Activate MFA on your Sakura Internet account and any other services where it’s available.
• Avoid Password Reuse: Ensure you are not using the same password for your Sakura Internet account on other online services.
• Monitor Account Activity: Regularly review your Sakura Internet account and associated email for any suspicious login attempts or unusual activity.
• Exercise Caution: Be wary of any emails, password-reset notices, or support communications claiming to be from Sakura Internet, as these could be phishing attempts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.