Summary: On 26 October 2026, JR Central, JR West and JR Kyushu announced that some members’ email addresses, member IDs, names in katakana and member type were leaked from Express Reservation (EX Yoyaku) and smartEX, the online booking services for the Tokaido, Sanyo and Kyushu Shinkansen. The leak happened at an outside company that sent emails for these services. According to JR, credit card numbers and expiry dates were not leaked, and neither were dates of birth, addresses or phone numbers. Affected members will be contacted individually by email or other means. The biggest risk now is fake emails that use your real name and member ID. This guide explains who is affected and what to do.
Based on the joint notice from JR Central, JR West and JR Kyushu dated 26 October 2026. Checked on 27 October 2026.
What happened
- 16 October 2026: Ymirlink, Inc. (Yumirurinku), the company that provides the email delivery service used by Express Reservation and smartEX, was hit by unauthorized access. At that time, Ymirlink told JR that users of these services were not affected.
- 26 October 2026: Ymirlink told JR that customers’ personal information had been viewed or taken by a third party. The three JR companies published a notice the same day and reported the case to Japan’s Personal Information Protection Commission.
JR says it has not found any leak from its own Express Reservation and smartEX systems. It stopped using the affected email service straight away.
Am I affected?
The notice says the people who may be affected are Express Reservation and smartEX members who were sent emails through Ymirlink’s email service, called Cuenote FC. JR gives two examples of such emails:
- promotional emails sent to some members
- emails telling members that the departure time of a booked train had changed because of the Kumamoto earthquake
The notice does not give a way to check this yourself on a website. Instead, JR says it will contact affected members individually by email or other suitable means. If you have an account with either service, it is sensible to act as if your email address might be in the leaked data.
How many people?
In the official notice, the number of people is listed as “being checked by Ymirlink”. Japanese media (Asahi Shimbun, via Yahoo! News Japan) reported a total of about 170,000 cases. Please treat the official count, when JR publishes it, as the final number.
What was leaked and what was not
| Item | Leaked? |
|---|---|
| Email address | Yes |
| Member ID | Yes |
| Name in katakana | Yes |
| Member type | Yes |
| Name in other scripts (kanji etc.), date of birth, address, phone number | No, according to JR |
| Credit card number and expiry date | No, according to JR |
Checked: 2026-10-27. Source: JR Central, JR West and JR Kyushu notice of 26 October 2026.
Many foreign residents register their name in katakana for Japanese services, so the leaked name may be the exact name that appears on your bookings and emails.
Should I cancel my credit card?
JR says card numbers and expiry dates were not part of the leak, so the notice does not ask you to change your card. However, Express Reservation and smartEX are services where you register a credit card to pay. It is a good idea to look at your card statement a little more carefully than usual for the next few months. If you see a charge you do not recognise, call your card company using the phone number printed on the back of your card, not a number from an email.
What you can do now
- Do not open links in emails that claim to be from JR or EX. With your email address, member ID and katakana name, a criminal can send an email that looks very real. Be careful with emails about an “apology”, a “refund”, “re-registering your card” or “confirming your account”.
- Check bookings in the EX app or a site you open yourself. Use the official app, or type the address or use your own bookmark. A correct sender name or your real name in the email is not proof that it is genuine.
- Never enter your password or card details from an email link. The notice does not list passwords as leaked, and it does not ask members to change them (as of 27 October). If you use the same password for other services, now is a good time to change it there.
- Watch out for text messages too. Fake messages often come by SMS as well as email. Our guide to fake SMS (smishing) in Japan and how to spot it shows common patterns and what to do if you tapped a link.
Where to ask
The notice of 26 October does not list a special contact point for this case (as of 27 October). Check for updates in the news releases of JR Central, JR West and JR Kyushu, or in the notices on the official Express Reservation and smartEX websites. Always open these sites yourself rather than using a phone number or link from an email.
FAQ
Q. I got an “apology” email from JR. Is it real?
A. It is hard to tell from how it looks. Do not use the links. Compare it with the notices in the EX app or on the official site that you open yourself.
Q. Are Eki-net (JR East) or e5489 (JR West) included?
A. The 26 October notice names only Express Reservation and smartEX members.
Q. My card number was not leaked. Do I need to do anything?
A. The main risk is fake emails, because criminals may know your real email address, member ID and katakana name. Follow the steps above and keep an eye on your card statement.
Q. I only used smartEX once, years ago. Could I be affected?
A. The notice says affected members are those who were sent certain emails through Cuenote FC. It does not give a date range. Wait for JR’s individual contact, and in the meantime treat JR-branded emails with care.
Related reading
日本語で読む：エクスプレス予約・スマートEXの会員情報が漏えい｜自分は対象？カード番号は？今やること
Sources
- JR Central, JR West and JR Kyushu, “Leak of email addresses and other data following unauthorized access at Ymirlink, Inc.” (in Japanese, 26 Oct 2026): https://jr-central.co.jp/news/release/nws000001_00634.html
- Asahi Shimbun via Yahoo! News Japan, report on about 170,000 cases (in Japanese): https://news.yahoo.co.jp/articles/b7bca3752d568962d5fd9f47a56cbd8d0ce47b19
