Arara Says Email Service Breach Has Grown to About 77m Addresses

Japanese email delivery company Arara says attackers took, or may have taken, about 77 million email addresses from client systems on its Arara Message service, a sharp rise on the 3.01 million it reported on 29 October. In a second report published on 2 November, Arara said the intrusion had spread to 97 servers holding the mailing lists of client companies, and that it shut the whole service down on 31 October.

The Arara data breach now reaches far beyond the single shared system TSN reported on 29 October. Arara counts email addresses, not people, and says the number is still being checked. Its parent, Tokyo-listed Paycloud Holdings, filed the same report with the stock exchange and says the effect on its earnings is under review.

How the Arara data breach grew

According to Arara’s report, which Paycloud repeated in its exchange filing, an outside party got into an Arara Message server and used it to break into many other servers on the service between 28 and 31 October, copying the contents of their databases. Arara’s timeline puts the data extraction between 01:36 on 29 October and 02:22 on 30 October, Japan time. Arara found this on 31 October while investigating the first incident, cancelled the credentials that had been misused, cut off each server’s connections and stopped the service.

On 97 servers in client environments, Arara says email addresses and member data were taken. That data covers whatever each client registered, which can include names, gender, dates of birth, phone numbers, member numbers and addresses, as well as records of where emails were sent. The number of client companies is still being checked; Arara’s current estimate is up to about 380. It says it holds no credit card numbers.

The count of about 77 million, as of 1 November, includes addresses Arara judges may have been taken based on how much data was read. Because one person can hold several addresses, Arara says the figure does not represent the number of end users.

The first incident was bigger than reported

The Arara data breach update also revises the account of the shared environment Arara disclosed on 29 October. Instead of about 3.01 million email addresses, the company now says 3,386,187 addresses linked to 61 client companies were taken, along with up to 411,827 customer records containing names and company names for five of those clients. The first report had said only email addresses were involved. The attacker logged into that environment’s admin screen on 27 and 28 October and used its data export functions.

Arara now blames a web server vulnerability combined with problems in its system environment, and says the same attacker appears to be behind both intrusions because of a common source. It has not named the flaw, and it is still investigating when and how the attack began. Arara reported the breach to the Personal Information Protection Commission, the police and the Japan Institute for Promotion of Digital Economy and Community (JIPDEC) on 29 October, and planned to update them on 2 November.

A mail platform is a master key to many brands

The scale of the Arara data breach comes from where the data sat. Arara does not have 77 million customers of its own. It sends newsletters, account notices and other mail for hundreds of companies, so a single compromise exposes the subscriber lists of every brand on the affected servers at once. Most recipients have never heard of Arara and will only learn they are affected if the brand they signed up with tells them.

The second danger is the sending power itself. Arara says attackers used its service to send up to about 7.13 million emails posing as a credit card company, from [email protected], with subject lines asking recipients to confirm their usage or statement. Those messages went to addresses the attacker brought in from outside, so they are not a measure of the stolen lists. But they show what the stolen data is for: a phishing email from a real, trusted sending platform gets past filters that would catch a fresh domain, and a list that pairs an address with a name and the brand it came from makes the next message more convincing.

Email address leaks keep recurring in Japan. TSN has covered Treasure Factory’s loss of 746,277 email addresses and the So-net breach that exposed 2.59 million records. The question the next Arara data breach report has to answer is which brands’ lists were on the 97 servers, because that is what tells people which emails to distrust.

What recipients and client companies can do

• Delete any email from [email protected] received between 28 and 30 October with subjects about confirming card usage or statements, and leave its links unopened, as Arara advises.
• Anyone who entered card details on a page reached from such an email should contact their card issuer straight away.
• Treat messages that claim to come from Arara or from brands you subscribe to with care, whether by email, SMS, phone or post, and go to the brand’s site directly instead of following a link.
• Arara says it never asks for passwords or card details by email. Client companies can reach its support desk on 03-5414-3611, and will be told individually whether their environment was affected.

Arara says the service will restart only once it has found the entry point, changed all credentials and confirmed the system is safe, and that clients will be asked to reset admin passwords and API keys. It has promised a third report with revised counts and the effect on earnings.

Sources

• Arara: Information leak and service suspension due to unauthorised access to Arara Message, second report (PDF, Japanese, 2 November 2026)
• Paycloud Holdings: Information leak and service suspension at Arara Message, second report (TDnet filing, PDF, Japanese, 2 November 2026)
• Arara: first notice on the Arara Message breach (Japanese, 29 October 2026)

Related stories

• Arara Says Hackers Took 3.01m Email Addresses From Its Mail Service
• Treasure Factory Says Hackers Took 746,277 Customer Email Addresses
• So-net Says Hack Exposed 2.59m Records and 54,401 Mail Passwords
• Muji Says App Breach May Have Exposed Up to 27.26m Customer Records