Japanese cloud and data center service provider Sakura Internet disclosed that hackers accessed its sales management system, where customer contract and membership information is stored.
In an update today to the initial notification from Monday, the company says the incident may have impacted up to 1,360,563 member accounts.
However, as the investigation continues, the exact number of affected accounts remains to be determined.
Sakura Internet is a major Japanese digital infrastructure company providing web hosting, VPS, public cloud, data-center, and GPU computing services.
It has been selected as a domestic provider for Japan’s Government Cloud program, making it a strategic entity in the country that reduces dependence on foreign hyperscalers.
According to the firm’s announcement, hackers accessed its IT system on August 9. The incident was discovered later during the investigation of a separate breach at the Sakura Rental Server service.
That hack was less severe, involving unauthorized logins to 583 accounts, access to customer-facing systems and client data, and the installation of malware onto Sakura’s systems.
The company says it invalidated all abused credentials and removed the malware; however, the discovery of the larger exposure makes the incident more significant.
Based on data collected in the investigation so far, 1,360,563 accounts were potentially compromised, though no data exfiltration has been confirmed.
The company said that stored passwords are hashed and should be hard to decipher even if stolen, while it also specified that the compromised system does not store any credit card information.
Sakura informed the relevant authorities of the hack and is individually notifying affected customers about their data being exposed.
It is unclear what type of malware Sakura detected in its environment, but the firm did not mention any operational or service disruptions.
BleepingComputer could not find a ransomware or data extortion threat actor claiming the attack on Sakura. We contacted Sakura Internet with a request for additional information, but we have not received a response yet.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report