, front page
InitialReach
How we report

SecurityArara Message breachChanged

Breach at Japan's Arara Message email service grows from about 3 million addresses to about 77 million, Arara's second report shows

Arara, which runs Arara Message, an email-delivery service companies in Japan use to send email to their customers, said on 2 November that about 77 million email addresses were taken from it, along with members' details such as names, birth dates, phone numbers and addresses. Its first report, on 29 October, counted about 3.01 million email addresses, from one system. Arara is a subsidiary of Pay Cloud Holdings, listed in Tokyo, which filed both reports with the stock exchange.

The second report says the attacker went beyond the shared system the first report covered, into 97 servers holding client companies' own data, used by up to about 380 companies, and took data from them between 28 and 31 October. For the shared system the count is now 3,386,187 addresses, and up to 411,827 customer records with names. Arara counts email addresses, not people, does not add the two counts because they may overlap, and says all of them are still being checked. It holds no credit card numbers, it says.

The attacker also used the service to send up to about 7.13 million emails from news@arara.com between 28 and 30 October, posing as credit card companies. Arara stopped the whole service on 31 October and has set no date to restart it. A third report is to follow.

Email addresses taken from Arara Message, by Arara's count

Before: About 3.01 millionNow: About 77 million

What changed

Before Information leak and service suspension after unauthorised access to Arara Message, 29 October 2026Now Information leak and service suspension after unauthorised access to Arara Message (second report), 2 November 2026

  1. Where data was taken

    Before

    One system, a shared environment

    Now

    That system, and 97 servers of client companies' own environments

  2. Client companies affected

    Before

    Not given

    Now

    61 in the shared environment; up to about 380 on the 97 servers, still being counted

  3. What was taken

    Before

    Email addresses

    Now

    Email addresses, and the member details clients stored: names, sex, birth dates, phone numbers, member numbers and addresses, depending on the client

  4. Count, shared environment

    Before

    About 3.01 million email addresses

    Now

    3,386,187 email addresses without duplicates, and up to 411,827 customer records with names, from five clients

  5. Count, client environments

    Before

    None: no other unauthorised access found

    Now

    About 77 million email addresses, including some possibly taken

  6. Cause

    Before

    A web server vulnerability, exploited by a third party

    Now

    That vulnerability, and problems in the system environment

  7. Phishing sent through the service

    Before

    A general warning about suspicious emails

    Now

    Up to about 7.13 million emails, sent on 28–30 October from news@arara.com, posing as credit card companies

  8. The service

    Before

    The affected server cut off from the network

    Now

    All of Arara Message stopped on 31 October, with no date to restart

What stayed the same

  • The first unauthorised access, in the shared environment, was found on 28 October.
  • The effect on Pay Cloud's results is still being assessed.

What we don't know yet

  • How many people are affected. The counts are email addresses, a person may have several, and the two parts may overlap, so Arara does not add them.
  • Which companies' customers are affected. Arara says it will tell each client company whether its environment is affected; neither report names any.
  • How and when the attacker first got in. Arara says it is still investigating.
  • What the “problems in the system environment” were.
  • Who the attacker is. Arara says only that, from the common source of the attacks, one third party appears to be behind all of them.
Check our translation The changed clauses in the original, beside our English

  1. The count (29 October)

    当社が提供するメール配信サービスのサーバーシステムのうち、1システムに対しての不正アクセスおよび本環境を利用するご利用企業様が保有するメールアドレス約301万件が外部に持ち出されたことを確認しております。

    Of the server systems of our email-delivery service, we have confirmed unauthorised access to one system, and that about 3.01 million email addresses held by the companies using this environment were taken out.

  2. Anything else (29 October)

    現時点において、発生した事象以外の不正アクセスによる影響は確認されておりません

    At present, no effect of unauthorised access beyond this incident has been confirmed.

  3. The count (2 November)

    既報の環境に加えて、本サービスに対する不正アクセスが判明したサーバーが拡大し、ご契約企業の会員情報等が外部に持ち出されました（持ち出された恐れのあるものを含みます）。持ち出されたメールアドレスは、現時点の調査で約77百万件（精査中。なお、本件は個人の方が複数のアドレスを保持している可能性もあるため、最終ユーザー数を示すものではありません。）です。

    Beyond the environment in the earlier report, the servers found to have been accessed without authorisation have grown in number, and client companies' member information and other data were taken out (including data that may have been taken). The email addresses taken number about 77 million so far (still being checked; as a person may hold several addresses, this is not the number of end users).

  4. What was taken (2 November)

    新たに持ち出された情報には、メールアドレスに加え、氏名等の会員情報（ご契約企業により異なる。）を含む顧客データが含まれていました。

    The newly taken information included, besides email addresses, customer data with member information such as names (which varies by client company).

  5. The cause (2 November)

    既報において「Webサーバーの脆弱性を第三者に悪用されたもの」とお知らせいたしましたが、調査の結果、当該脆弱性に加え、システム環境における問題も本事象の発生に関係していたことが判明いたしました。

    In the earlier report we said that “a third party exploited a web server vulnerability”; the investigation found that, besides that vulnerability, problems in the system environment also played a part.

  6. The service (2 November)

    当社は、2026年10月31日に本サービスの提供をすべて停止いたしました。再開の時期は未定です。

    We stopped providing the whole service on 31 October 2026. When it will resume has not been decided.

The documents

For people in the field Identifiers, citations and the trade's shorthand, from the documents
How the data was taken
Per the second report: in the shared environment, the attacker logged in to the management screen without authorisation and used its data-export functions; Arara shut that environment down at 16:31 on 28 October. In the client environments, the attacker got into a server of the service and went through it into many of the service's servers, taking the contents of their databases. Counts of data “possibly taken” are judged from the volume of records read.
Timeline, Japan time
27 October 08:36, access that appears to be reconnaissance; 28 October about 03:59, phishing sent through the service begins, 07:00 outside access to that environment stopped, about 08:47 sending begins from another environment, 11:09–15:43 unauthorised login to the shared environment's management screen and data taken, 16:31 shared environment shut down; 29 October 01:36 to 30 October 02:22, data taken through the service from client environments; 29 October, first report and preliminary report to the Personal Information Protection Commission; 30 October 13:08, the second sending found, 13:26 that environment cut off, last email 13:32; 31 October morning, the taking from client environments found, from 12:58 accounts and keys revoked and servers cut off, 19:53 service stopped.
The phishing emails
Sender news@arara.com; subjects such as 「利用内容確認のご依頼」 and 「ご利用明細確認のご依頼」 (requests to confirm card use and statements); sent to addresses the attacker brought in from outside. Arara found no leak beyond email addresses from the sending itself.
Data held per client
Per the second report's annex: member information (address books), meaning email addresses and the fields a client registered, taken from about 97 servers and, in the shared environment, from five clients; clients' API keys, suspended; names and email addresses of client staff who use the management screen, still being checked. Clients will be asked to reset management passwords and API keys before the service restarts.
Reports to authorities
Personal Information Protection Commission: preliminary report 29 October, the new findings to be reported 2 November. Police: notified 29 October. JIPDEC, which runs Japan's PrivacyMark scheme: preliminary report 29 October, interim report 2 November.
Companies
Arara Inc. (アララ株式会社) is a consolidated subsidiary of Pay Cloud Holdings Inc. (ペイクラウドホールディングス株式会社), Tokyo Stock Exchange Growth market, code 4015. Pay Cloud's fiscal year ends in August; the effect on the year to August 2027 is being assessed.