Arara, a Japanese company that sends marketing and notification emails for other businesses, says an attacker broke into one of its mail servers and took about 3.01 million email addresses. The addresses belong to people on the mailing lists of companies that use its Arara Message service.
Arara’s parent, Tokyo-listed Paycloud Holdings, disclosed the breach in a stock exchange filing on 29 October. Arara has posted the same account on its corporate site and in notices to customers on its service site. It is the second breach at a Paycloud subsidiary in under two weeks.
In brief
- Arara says about 3.01 million email addresses were taken from one server environment of its bulk email service.
- It says no other data was taken. The cause was a web server flaw that an outside party exploited.
- Service on the affected environment is suspended, with no restart date.
- On 23 October Paycloud disclosed a separate hack at another subsidiary, which exposed 1.42 million prepaid card records.
What Arara says happened
According to the filing, Arara confirmed on Wednesday 28 October that someone had gained unauthorised access to part of its systems. It disconnected the server from the network straight away. The attacker got into one system and took the email addresses held there by the client companies using that environment. Arara says the cause was “the exploitation by a third party of a web server vulnerability” in part of its environment. It has not named the software or the flaw.
The breach unfolded over two notices on 28 October. The first said Arara had found unauthorised access and suspended service on the affected environment, and that no leak had been confirmed. It added that emails already scheduled before the suspension would still be sent. The second, posted later the same day, said a leak had now been confirmed. The data taken was “email addresses registered in end-user lists”, and Arara says it has found no sign that anything other than email addresses was taken. That notice names the affected environment as “bvam001” and says Arara is still working out which client companies’ lists were involved.
Arara says it has seen no effect on its other services. With outside specialists, it plans to re-check every service for vulnerabilities, and it says it will share details of the attack with client companies and the relevant bodies. Paycloud says it is assessing the effect on its earnings and will disclose anything material. Neither company has said when the affected service will restart.
A second breach at Paycloud in two weeks
Six days earlier, Paycloud filed a separate notice about another subsidiary, Valuedesign. Valuedesign runs Value Card, a service that lets retailers issue their own electronic money cards. On 19 October it found that ID numbers, PINs and balance data for 1,424,748 cards had been taken: 569,224 cards already issued and 855,524 not yet sold. No personal information was involved. Paycloud said there had been a risk of misuse for the issued cards, that this had been dealt with, and that no actual losses from misuse had occurred.
The two filings give the cause in identical words: a web server vulnerability in part of a subsidiary’s environment, exploited by a third party. Paycloud has not said whether the two intrusions are linked or used the same flaw.
What people on the lists should expect
Most people whose addresses were taken will never have heard of Arara. They signed up to newsletters or account emails from shops, services and other brands that used Arara Message to send them. That makes the leak hard to spot from the outside. Arara asks anyone who receives a suspicious email not to click any link in it, reply, open attachments or enter IDs, passwords or other personal details, and simply to delete it.
The incident follows a run of email address leaks in Japan. Last week Treasure Factory said hackers took 746,277 customer email addresses, and this week So-net said a breach exposed 2.59 million member records, including mail passwords for some accounts. Japan Airlines has also said a breach at its booking system provider exposed data on 92,000 customers.
TSN’s analysis: one email platform, many brands exposed
TSN’s analysis: on its own, an email address is a small thing to lose. The risk here comes from where the addresses were stored. Arara’s servers hold addresses that real brands use to email their customers. If the stolen data shows which company’s list each address came from, that is the raw material for convincing phishing, because a fake message from a shop you really do get emails from is easier to trust than a random one. Because Arara’s notice gives no list of affected brands, people cannot easily tell which of their accounts to watch.
The Paycloud group now has two web server breaches at two subsidiaries in under a fortnight, both described in the same words. Paycloud promised a vulnerability check across all its services in its 23 October filing, five days before Arara’s server was breached, and has repeated the promise now. The useful disclosures would be whether that check had reached Arara’s environment, and whether it finds a common flaw.
Compliance and reporting questions
For the companies that used Arara Message, this is a supplier breach of their own customer data. Japan’s personal information law generally requires businesses to report leaks caused by unauthorised access to the Personal Information Protection Commission and to notify the people affected. When a contractor handles the data, the client company usually remains responsible to its own customers. Arara has not said whether it or its clients have filed reports. Its notices say only that it is sharing information with the relevant bodies.
For banks, payment firms and crypto platforms, a list of millions of addresses tied to known brands is the kind of data that feeds account takeover and fake support scams. Firms with Japanese customers should expect more brand-impersonation emails and remind customers how they really communicate. The Value Card incident adds a payments angle. Card IDs, PINs and balances can be enough for a fraudster to spend stored value, which is why Paycloud’s statement that the risk was dealt with before any losses matters.
Sources
- Paycloud Holdings: Unauthorised access to Arara Message, information leak and service suspension (TDnet filing, 29 October 2026, Japanese, PDF)
- Arara: Unauthorised access to Arara Message, information leak and service suspension (corporate notice, 29 October 2026, Japanese)
- Arara Message: Service suspension due to unauthorised access (28 October 2026, Japanese)
- Arara Message: Apology and report on service suspension and personal data leak (28 October 2026, Japanese)
- Paycloud Holdings: Unauthorised access to a system provided by a consolidated subsidiary (Value Card, TDnet filing, 23 October 2026, Japanese, PDF)
- NHK: About 3 million email addresses leaked at mail delivery firm Arara after unauthorised access (29 October 2026, Japanese)
Related stories
- Treasure Factory Says Hackers Took 746,277 Customer Email Addresses
- So-net Says Hack Exposed 2.59m Records and 54,401 Mail Passwords
- JAL Says Amadeus Breach Exposed Booking Data on 92,000 Customers
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
