Shippio confirms customer-data access, document downloads and unauthorized API credentials

Shippio says an internal business tool was accessed from October 30 and stored credentials were used to reach Shippio Platform. Its public November 4 notice describes repeated platform access between approximately November 1 19:30 and November 2 17:00 Japan time. Detection and the service pause occurred on November 2; that pause is not evidence that the entire intrusion window ended immediately. All known routes are now blocked, according to the company. It has not named the internal tool, a CVE or a fixed customer software version; no connection to other recent SaaS incidents is established.

Company names, team names, phone numbers and addresses were viewed for all customers. Shipment information and document filenames/types were viewed for almost all customers that had registered shipments. Approximately 1,300 document files were downloaded, with their details still being investigated. Some internal shared files were viewed or taken and may contain customer information; other internal documents contained non-user personal information whose scope remains under investigation. User names/emails were accessible, but bulk acquisition has not been observed. Shippio says platform login passwords were held by an external authentication provider, not stored in its own systems, and were not acquired in this incident. These categories must not be collapsed into one confirmed-person total.

The company confirms unauthorized user accounts and API credentials affecting approximately 1,100 contracted teams, settings writes and malicious shipment-file uploads. It reports no evidence customers downloaded those malicious files and no confirmed rewriting of shipment business data. It removed unauthorized accounts/credentials and malicious files, restored changed settings, disabled the internal tool and changed or invalidated related credentials. It reset all login states; further environment/data-access validation and regulatory reporting/consultation remain in progress. No misuse of leaked information has been confirmed, which is not proof none occurred.

L4 reflects confirmed broad customer-data access and attacker-controlled accounts/API credentials in a shared logistics platform. The company remains in maintenance mode without a reopening deadline. Customer notices began November 2; the public article is dated November 4. No financial-loss figure or complete recovery is established.

November 6 timeline clarification: The revised original dates the entry-point business tool shutdown to approximately November 2 11:40 Japan time (02:40 UTC) and completed blocking of related unauthorized platform access to 17:38 Japan time (08:38 UTC). Between those actions, the team investigated routes involving credentials obtained through the tool. The platform had entered maintenance at 10:40 Japan time (01:40 UTC); neither maintenance nor stopping the tool alone established complete containment. The vendor has not changed the confirmed exposure categories or announced a reopening date.