Openlogi says hackers took recipient data from seven months of shipments

Openlogi says hackers took recipient data from seven months of shipments

11 November 2026: Openlogi, a Japanese platform that stores, packs and ships goods for online sellers, says an outside party broke into its system and took part of the shipping data it holds. The data covers the recipients of every shipment its clients requested from 8 April to 8 November 2026: names, addresses, phone numbers, email addresses where registered, and the products and quantities sent.

Not yet independently verified. The account of the intrusion is Openlogi's own; it has not said how the attacker got in or how many records were taken. THECOO, a client, says its information may be affected but gives no figures. We will update this when it can be confirmed, and remove this note.

Two days of access, closed on 9 November

According to the company's notice of 11 November, the unauthorised access ran from Sunday 8 November to Monday 9 November. Openlogi blocked the route it had identified on 9 November and has seen no further access since. It carried out emergency maintenance, is checking the safety of its systems and is working with outside security specialists on the cause, the way in and the extent of the damage. It has not yet given any of those, nor a count of the records taken.

Credit card numbers are not involved, the company says, because it does not hold them. As of 11 November it had found no misuse of the data and no secondary harm. Warehouse receiving and shipping carry on as normal, apart from some system functions affected by the maintenance.

Openlogi says it will report the incident to Japan's Personal Information Protection Commission and is consulting the police.

Why the sellers on the platform have work to do

The people whose data was taken are not Openlogi's customers but their customers: the shoppers who bought from the brands and online shops that use Openlogi for fulfilment. Those sellers hold the relationship, and several are now publishing their own notices. THECOO posted one on PR TIMES on 13 November, saying it uses Openlogi for some of its services, that some of its information may fall within the leak, and that it is still investigating.

Openlogi asks its clients to check their accounts and report anything unusual, and to warn recipients about a specific risk. Because the stolen records pair a name and address with what was ordered, they suit phishing that impersonates a delivery company. The company advises recipients not to open delivery notices they do not recognise, not to follow suspicious links, and not to enter personal or payment details when asked by email, text message or phone.

For a seller, that warning reads better coming from the shop the customer actually bought from, with the dates of the affected shipments.

Fulfilment software in our catalogue

Our warehouse management software category lists 22 products. Openlogi is not one of them, and an incident like this is a reminder that a fulfilment partner holds the same personal data a shop does, often for every order it has ever shipped.

Openlogi says it will publish new facts, and anything more clients or recipients need to do, on its website.

Related on TrustList:

• Tutor Intelligence raises $75M Series B for warehouse robot fleets

Sources

• Openlogi: notice of personal information leak caused by unauthorised access (Japanese), 11 November 2026
• THECOO via PR TIMES: notice on the Openlogi incident (Japanese), 13 November 2026