On September 10, 2026, Sakura Internet published a third report covering two unauthorized accesses: one detected on August 9 in Sakura Rental Server environments, and another in its sales-management system. The company did not establish a link between the events; access to the sales system occurred between April 2023 and March 2026.
Information from 951 Rental Server accounts and 1,360,563 accounts in the sales system may have been viewed or obtained; the latter scope includes Rental Server customers. Sakura found no clear evidence of exfiltration. It also says unhashed initial passwords for some Rental Server and VPS accounts may have been in scope, without disclosing a count.
What Sakura found
Sakura says part of its rental-server environment was accessed without authorization and malware was installed on some servers. It isolated environments, reviewed access and engaged external specialists.
The sales system also experienced unauthorized access, but Sakura did not establish that it was linked to the August 9 Rental Server event. Information relating to 1,360,563 accounts may have been in scope; for 30 accounts, a hashed member-account password may have been viewed. That figure does not include the unhashed initial server passwords, whose number was not disclosed.
The company found no clear evidence of exfiltration or secondary harm attributable to the accesses at the time of the report. It says affected initial server passwords were stored unhashed in the sales system.
Why the scope changed
The potential Rental Server scope rose from 583 to 951 accounts after 368 more accounts were added. Sakura found no clear evidence linking those 368 to the event involving the original 583, but could not rule out all impact. The sales system is a separate scope: access there was observed over a different period.
A “potentially affected” account does not mean all its data was confirmed accessed or exfiltrated. Sakura says it individually notified affected customers and changed Rental Server passwords it knew were still in use; some VPS customers were asked to change their initial password.
Checks for a hosted website
If you are a Sakura customer, check the member portal and official notices; do not reply to an unexpected message with a password. Follow Sakura’s password-change instructions, especially if you still use an initial Rental Server or VPS password. The company says it did not retain passwords after customers changed them from their initial values.
For your website, review administrator accounts, recently changed files, scheduled tasks, redirects, mail accounts and login logs. Look for changes your team cannot explain.
Do not download a supposed remediation tool from an email. Use Sakura’s customer portal or official website, and preserve useful evidence before restoring a compromised site.
The risk of reused secrets
A password copied across hosting, a CMS and email increases the impact of a limited access event. Rotation should cover actual accounts, API keys and administrator access. Our team password-sharing guide can help organize shared access.
The Soclyde connection
Soclyde cannot replace provider controls or prove a website’s integrity. It helps keep separate secrets for hosting, the CMS and email in an encrypted vault that makes rotation easier after a supplier alert.
Takeaway
Sakura Internet reports two distinct accesses, 951 Rental Server accounts and up to 1,360,563 accounts whose sales-system information may have been in scope. No exfiltration is confirmed, but some unhashed initial passwords may have been accessible. Follow your Sakura notice and change reused secrets from a clean device. To generate strong replacements, use the secure password generator or contact Soclyde.
