- A threat actor claims to breach the CloudLogi system of Starx Inc. allowing for the leakage of millions of customer records dating from 2017 to 2026.
- The reportedly compromised information includes personal details, such as names and email addresses of Japanese citizens.
- Starx has not acknowledged the occurrence of the breach & experts continue to consider the information as unconfirmed until further evidence appears.
A threat actor recently posted a claim about Starx Inc. on an underground forum. The seller says the CloudLogi platform of the company was compromised. The claim involves nearly 11 million customer records.
Starx Inc. is a Japanese technology company. It provides digital transformation and e-commerce solutions. The company also runs CloudLogi, a cloud logistics platform – which handles shipping and warehouse services for online stores.
What the Claim Says
The actor, known as ‘skra,’ claims the breach exposed customer information from client shops. The post satted that this data covered the period from 2017 to October 2026 – and the dataset contains names, emails, and phone numbers. The claim also included dates of birth and residential addresses.
A separate dark web intelligence post reports similar details. It notes that the dataset contains around 11 million rows of data of customers. The post also notes that the seller offered the data for download. The alleged records include full names and physical addresses.
The seller did not publish a price in the public post. Interested buyers had to contact the actor directly. This pattern is common on forums that sell stolen data. Sellers often share small samples first. They then negotiate with buyers in private messages.
The sample in this case reportedly included real names and contact details. It also showed addresses from several Japanese prefectures. Experts involved in examining the sample said that data seemed to be structured. Also, it appeared as an extract from a database rather than from random websites, which adds credibility to the claim, but it still needs more proof.
Background on Starx and CloudLogi
Starx Inc. started operations in 2012. The company focuses on commerce and digital transformation. Its CloudLogi service came into play in 2018. The service makes use of AI technology to predict demand and deliver products from different warehouses simultaneously. The service has acquired more than 600 customers.
CloudLogi processes sensitive information of customers that shop online. This includes order details and shipping information. A breach of this platform would affect not just Starx, but also its many retail clients. Those clients trust Starx to protect their customer records.
Separately, Ukraine’s strikes on Yandex data centres have sparked claims about Russian bots, highlighting wider concerns about the role of technology infrastructure in cyber and information operations.
The role of the platform makes the alleged breach more serious. The CloudLogi service operates as a bridge between merchants and the delivery companies. It can see names and addresses of customers and their purchasing history. The service also stores account information about the shops and their customers. A single leak of such information could cause damage to both merchants and customers.
Starx positions itself as a provider paying attention to security. Its website mentions data protection features and compliance. The company claims it complies with privacy laws in Japan. It also claims to encrypt customer data while storing it and during transfers. So, a real breach would raise serious questions about those claims.
The Claim Remains Unverified
Starx has not confirmed any security incident. The company has issued no public statement about the claim. Authorities in Japan have not commented on the matter. The authenticity of the dataset remains unproven.
Security analysts treat such forum posts with caution, this is because threat actors sometimes exaggerate or fabricate claims. They may also repackage old data from unrelated breaches. Without any independent verification, the claim will remain unconfirmed.
The timing of the post is also notable. Firstly, the actor posted the claim on a forum notorious for selling stolen data. Then, the post featured a sample of the alleged dataset; however, samples alone do not prove a breach. Investigators would need technical evidence establishing a link between the data and Starx systems to conclude that there was a breach.
Meanwhile, Japan has witnessed a slew of data incidents in recent years. In 2025, a major logistics firm announced an incident of unauthorized access to its order systems.
That specific incident had caused the privacy regulator of Japan to provide fresh guidance to companies on reviewing third-party access and retention of logs. Starx operates in the same sector, so regulators may look closely at this claim.
What this Means for Affected Users
In the event that the claims turn out to be true, countless customers from Japan may find themselves in danger. Phishing attacks may use their details, such as name or home address. Also, scammers will manage to write fake notifications of delivery or impersonate stores and couriers. Such attacks will become significantly harder to detect if the spoofers incorporate correct information.
If a customer has shopped with CloudLogi, it will be wise to keep an eye open. Users should check all unexpected messages about incoming deliveries or orders. Also, they should not click on links included in dubious emails or texts, contacting the retailer directly is safer than responding to the message.
Starx clients should also review their security posture. They should ask Starx for clarity on the claim. They should monitor their customer accounts for unusual activity. If the breach is real, they may need to notify their own customers.
Japanese privacy law requires companies to report serious breaches. They must inform the Personal Information Protection Commission in some cases. They must also notify affected individuals promptly. Starx has so far made no such notification public. That silence does not prove anything, but it leaves the claim open.
