Notice Regarding Potential Leak of Personal Information Due to Unauthorized Access at RAKUS Light Cloud Co., Ltd. (Update / Second Report)

Japan Petroleum Exploration Co., Ltd. (JAPEX) hereby announces an update regarding the unauthorized access incident involving the services of RAKUS Light Cloud Co., Ltd. (RAKUS Light Cloud), which JAPEX uses for information dissemination, as previously announced on October 21, 2026.

Following an investigation conducted by RAKUS Light Cloud and specialized agencies, it has been confirmed that JAPEX's distribution list information was not included in the data exfiltrated externally.

We sincerely apologize for any concern and inconvenience this incident may have caused to all relevant parties.

1. Background

JAPEX uses "blastmail," a cloud service provided by RAKUS Light Cloud, as a distribution tool for the "JAPEX Newsletter" --which notifies subscribers of new materials and content updates on our website--as well as for sending event invitations to institutional investors and securities analysts. On October 21, 2026, JAPEX was informed by RAKUS Light Cloud that personal information registered on its service may have been leaked externally due to unauthorized access to its cloud environment. A subsequent investigation conducted by RAKUS Light Cloud and external cybersecurity experts confirmed that JAPEX's distribution list information was not among the compromised data.

2. Information Subject to Investigation in This Incident

• Information of subscribers to the JAPEX Newsletter
  ・Email address

• Information of recipients of event announcements for institutional investors and securities analysts
  ・Name, company name, department, job title, email address, postal code, address, and phone number

3. Response to Affected Individuals and Parties

"blastmail" is an external cloud service that operates independently of our systems. This incident has had no impact on our networks, systems, or business operations.

   We once again express our deepest apologies to our subscribers and all stakeholders for any concern caused. We have reaffirmed the importance of protecting personal information and will continue to take steps to prevent a recurrence.