Japan's Arara Email Breach Climbs Past 81 Million Addresses as Banks, Retailers and Cities Warn Customers

By Kaeleb Savon Heck

TOKYO, Nov. 10, 2026 — A breach at Arara Inc., a Japanese company that sends marketing and notification email on behalf of hundreds of businesses, has kept growing, with the company now saying more than 81 million email addresses were taken or may have been taken from its systems.

In its third report on the incident, published Nov. 6, Arara said the deduplicated total of email addresses carried out of its "Arara Message" delivery service stands at 81,329,467. That is up from about 77 million in its second report on Nov. 2 and roughly 3 million in its first notice on Oct. 29. Arara stresses the figure counts addresses, not people, since one person can have several addresses or be signed up with several companies.

The damage goes beyond email addresses. Depending on what each client company stored with Arara, the stolen records include names, gender, dates of birth, phone numbers, member numbers and home addresses. Arara's figures break out about 47 million addresses that came with that kind of extra information and about 34 million that were email addresses alone.

The attacker also used Arara's own service to send up to about 7.13 million phishing emails dressed up as credit card company notices. Arara Message has been fully shut down since Oct. 31, and the company says it has no date to restart it.

How the breach unfolded

Arara and its listed parent, Paycloud Holdings, have laid out the timeline across three formal disclosures.

According to the reports, access that the company now believes was reconnaissance took place on Oct. 27. On Oct. 28, the attacker logged into the administration screen of a shared environment used by multiple clients and abused its data export features. On the same day, Arara found its service being misused to send suspicious mail and cut off outside access to one environment at 7 a.m. Japan time.

The intrusion did not stop there. From Oct. 28 through Oct. 31, the attacker got into an Arara Message server and used it as a jumping-off point to reach 97 servers that hold individual client companies' environments, copying out the contents of their databases. A separate cloud environment, which Arara calls "Environment B," was also accessed during that same window using misused credentials. That second environment was not counted until the Nov. 6 report, which added 3,249,492 addresses from it.

Arara says it discovered the wider intrusion on Oct. 31 while investigating the original incident. That day it revoked the credentials the attacker had used, blocked network traffic to its servers and shut down the entire Arara Message service, finishing the shutdown at 7:53 p.m.

The company first described the cause as a web server vulnerability. In its second report it said the vulnerability, together with problems in its system environment, contributed to the incident. It has not said how or when the attacker first got in, and says that remains under investigation with outside experts.

The numbers, and why they keep changing

Arara's count has been revised in every report, which is common in large breaches as investigators widen their search.

The Nov. 6 report breaks the total into three parts:

• 78,102,937 addresses from the client environments reached through the Arara Message service.
• 2,842,400 addresses from the shared environment named in the first notice, corrected down from the 3,386,187 reported on Nov. 2.
• 3,249,492 addresses, email only, from the separate cloud environment found later.

After removing overlaps between those groups, the total is 81,329,467. Arara estimates up to about 380 client companies are affected, a figure that includes the 61 companies tied to the shared environment. It notes the counts are still being checked and could change.

The phishing run is counted separately. Between Oct. 28 and Oct. 30, the attacker sent up to about 7.13 million messages from the address [email protected], using subjects that translate as requests to confirm card usage or a card statement. Arara says those messages went to addresses the attacker brought in from outside, and that it has found no data leaking from the sending itself beyond email addresses. The last one went out at 1:32 p.m. on Oct. 30, Japan time.

Arara says its service never held credit card numbers.

Who is affected

Because Arara sits behind the scenes, most people whose data was taken have never heard of it. They signed up for a newsletter, a loyalty program or a city service, and that organization used Arara to send the mail.

Affected organizations have been issuing their own notices. A running tally by the Japanese security site Phishing JP, updated through Nov. 8, lists many of them, with figures drawn from each organization's own announcement:

• Asoview, a leisure booking service, reported 15,821,184 records, including names, birth dates, phone numbers and ticket purchase details.
• Bic Camera, with its Kojima and Sofmap chains, confirmed 15,204,757 records leaked in a Nov. 6 update.
• Shogakukan, the publisher, reported 1,993,665 records that may have leaked.
• TKC, a systems company that serves local governments, reported up to 2,230,812 addresses, and said it found no intrusion into its own or municipal systems.
• Matsui Securities reported up to about 830,000 customer email addresses, and Sumitomo Mitsui Banking Corp. reported 227,216, mostly for corporate customers.
• Yokohama said about 820,000 registered accounts on a city system may be affected. Phishing JP notes that is a registration count, not a confirmed leak count.

The fallout has also reached well-known entertainment brands. BleepingComputer reported that game publisher SEGA said 2.2 million newsletter subscribers' email addresses were exposed through Arara, along with 92,300 records with additional information still being identified. SEGA said customer names, addresses, phone numbers, payment details and passwords were not included, and that email tied to "SEGA Account" logins goes through a separate system.

Phishing JP warns that company-by-company figures cannot simply be added together, because the same address may appear in more than one company's list and in Arara's overall total.

Analysis: one vendor, hundreds of victims

The Arara breach is a textbook case of supply-chain risk. Hundreds of businesses and public offices handed their customer lists to a single email vendor, and one compromise exposed all of them at once.

It also shows how deep those chains run. Phishing JP documents cases where a company used a marketing tool, which in turn used Arara's "repica" delivery service, or where fan clubs used an outside operator that relied on Arara Message. Some affected organizations never signed a contract with Arara at all. That makes it hard for people to know whether they are affected, and hard for organizations to know where their data actually lives.

The phishing wave is the most immediate danger. Attackers now hold millions of real email addresses linked to real services, often with names and birth dates. That is exactly what makes a fake "please confirm your account" message convincing. A phishing email that uses your real name and the name of a store you actually shop at is far more likely to work than generic spam.

For blind and low-vision readers who use screen readers, that risk deserves extra attention. Visual cues that sighted users sometimes rely on, like a slightly off logo or odd formatting, are not available through speech. Checking the actual sender address and the real destination of a link, which most screen readers can announce, matters more than how an email sounds.

What people should do

Arara, Paycloud and the affected companies have given consistent advice:

• Delete messages from [email protected] that pose as credit card companies, and do not open their links.
• If you entered card details on a page linked from one of those messages, contact your card issuer immediately.
• Be wary of email, text messages, phone calls or letters that claim to come from Arara or from any company that used its service.
• Do not trust a message just because it includes your real name, birth date or the name of a service you use. Go to the company's official app or website directly instead of using a link.

Arara says neither it nor its group companies will ask for passwords or credit card information.

What's next

• Service restart: Arara says it will decide on restarting Arara Message only after closing the intrusion route, getting a safety check from outside specialists and having client companies reset their credentials, including API keys. No date has been set.
• Final counts: Arara says confirming the final number of exposed records and the root cause will take more time, and it will keep publishing updates.
• Regulators: Arara reported the incident to police on Oct. 29 and has filed reports with Japan's Personal Information Protection Commission, the data protection group JIPDEC and the Kanto Bureau of Telecommunications of the Ministry of Internal Affairs and Communications.
• More notices: With up to about 380 client companies involved, more organizations are expected to announce that their customers were affected.

Sources

• Arara Inc., statement of apology and next steps on the Arara Message breach (Japanese), Nov. 6, 2026: https://www.arara.com/news/info/20261106_arara
• Arara Inc., second report on the Arara Message breach (Japanese, PDF), Nov. 2, 2026: https://www.arara.com/dcmsmedia/other/arara20261102__.pdf
• Paycloud Holdings, third report on the Arara Message breach (Japanese, PDF), Nov. 6, 2026: https://contents.xj-storage.jp/xcontents/AS71226/0d5f3847/6172/4bcc/bfab/73896dab795d/20261106211906670s.pdf
• Phishing JP, running list of affected companies and local governments (Japanese), updated Nov. 8, 2026: https://phishing.jp/news/arara-message-data-breach-affected-companies-202610/
• BleepingComputer, "SEGA newsletter data breach exposes 2.2 million email addresses": https://www.bleepingcomputer.com/news/security/sega-newsletter-data-breach-exposes-22-million-email-addresses/
• eSecurity Planet, "Arara Message Breach Puts 77M Email Addresses at Risk": https://www.esecurityplanet.com/threats/news-arara-message-breach-77-million-email-addresses-japan-apac/
• Frame, "Arara now says about 77 million email addresses were taken, plus names and birth dates for some": https://frameprivacy.com/blog/arara-message-77-million-email-addresses-2026