Raksul: print-job and invoice data may have left after unauthorized access

Raksul, the Japanese online printing company, says third parties got into a system that handles customer data uploads for its Raksul service, and that personal details inside print files, invoices and related records may have left. The firm found the access early on November 8, 2026, and published a notice on November 9. It says credit card numbers, login IDs and passwords did not leave.

What happened

According to Raksul’s November 9 notice (in Japanese), staff detected unauthorized access to the data-upload processing system at about 12:20 a.m. on November 8. Authentication credentials for the company’s systems had been obtained improperly, and part of the data Raksul keeps was reachable from outside. The company disabled the misused credentials, stopped the accounts used in the access, and paused services that involve data uploads from November 8 while it investigated. Some of those services began returning on November 9; a few package, design and catalogue offerings stayed offline.

What may have been exposed

Counts and the full date range are still being worked out. As of the notice, data that may have left includes:

• Personal details written in print files customers uploaded, plus data in invoices and web-mail products: name, company name, postal address, phone number and email address.
• Print files can also hold details of other people named on the print (for example on business cards or postcards), not only the customer who ordered.

Raksul says it has confirmed that credit card information, login IDs and passwords did not leave. It plans to report to Japan’s Personal Information Protection Commission and will post updates on its site. It says it has not confirmed secondary misuse so far.

What this means for you

If you ordered print from Raksul, or if your name and address appeared on someone else’s business cards or postcards printed there, those details may be in the set. That is enough for convincing “Raksul reprint,” billing or delivery messages. Cards should be unaffected according to the company.

What you can do

1. Watch Raksul’s site for follow-up notices and any individual contact once counts are clear.
2. Treat unexpected Raksul, print or courier messages as suspect, even if they use your real name or a past order. The company says it will not ask for a password or card number by email or SMS outside your own account flow.
3. Use Raksul’s contact form (choose the personal-information desk) if you have questions. Answers come on weekdays, 10:00 a.m. to 6:00 p.m. local time.
4. See how scammers use leaked data to make phishing personal if a message already seems to know your print details.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each printer or shop its own address, so a fake message that arrives at the wrong one stands out. Frame never collects or stores the leaked records themselves.

Related coverage

• Nitori: personal details of up to about 37.62 million customers may have been taken: another large Japanese consumer disclosure the same day.
• How scammers use leaked data to make phishing personal.

Sources

• Raksul, Notice: possible personal data leak after unauthorized access to our systems (in Japanese), November 9, 2026
• ITmedia NEWS, Unauthorized access at online printer Raksul; print data may have left (in Japanese), November 9, 2026