Arara email service cyber-attack exposes 81.33 million email addresses
Japan's Arara Message email delivery service was breached through a web server vulnerability, exposing email addresses and some customers' member information. Further investigation put the number of unique email addresses exposed at 81,329,467. The attacker also misused the service to send up to approximately 7.13 million emails impersonating credit card companies, and the company isolated the servers and suspended its email delivery service entirely.
Key facts
- Affected organisation
- Arara
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- 81,329,467 email addresses and some customers' member information
- Cause / method
- Exploitation of a web server vulnerability to access customer servers through a shared environment
- Location
- Japan
If your data was exposed
Exposed dataEmailNamePhone numberAddressUsage & purchase history
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- The company disclosed the exposure of approximately 3.01 million email addresses, isolated the affected servers and suspended the service.
- The scope expanded to 97 servers in customer environments and up to approximately 380 companies, with an estimated 77 million email addresses affected.
- Investigators confirmed that customer servers had been breached through a shared environment and that up to approximately 7.13 million emails impersonating credit card companies had been sent.
- Further data theft in another cloud environment was discovered, bringing the number of unique exposed addresses to 81,329,467.
- No date had been set for resuming the email delivery service.
- The exposure of 80,000 email addresses belonging to Kobe City became known.
Also affected by this incident
Asoview service provider breach exposes 15,821,184 member records
↳ Knock-on damage from the Arara incident · View original incident15.8mImpact: 15,821,184 member records
Leisure booking service Asoview disclosed that 15,821,184 member records had been exposed following unauthorised access at Arara, its email delivery service provider. The exposed information included email addresses, names, phone numbers, last login dates, facilities used and ticket purchase and cancellation histories, while the number of people affected has not been established. Asoview said it had not entrusted passwords or payment card information to the provider.
Related reports: 2 →Around 490,000 Solaseed Air customer email addresses leaked
↳ Knock-on damage from the Arara incident · View original incident490kImpact: Around 490,000 customer email addresses
Around 490,000 email addresses belonging to Solaseed Air customers were leaked externally. Unauthorised access to an external email system was confirmed as the cause, and Arara was identified as the system’s provider.
Related reports: 3 · last report →Arara email service breach exposes up to 2.23 million TKC user email addresses
↳ Knock-on damage from the Arara incident · View original incident2.2mImpact: Up to 2,230,812 user email addresses
Further disclosures revealed that up to 2,230,812 email addresses belonging to users of systems operated by TKC were exposed through a breach of Arara’s email service. An investigation is examining whether information belonging to users of local authority online application services, including those in Yokohama and Kawasaki, was also affected.
Read on The Boston Report ↗Unauthorised access to Arara may have exposed up to 4,700 Fukushima personal data records
↳ Knock-on damage from the Arara incident · View original incident4.7kImpact: Potential leak of up to 4,700 personal data records
Unauthorised access to Arara was found to have potentially caused a personal data leak affecting the City of Fukushima as well. Up to 4,700 records may have been exposed.
Related reports: 2 · last report →Around 227,000 customer email addresses leaked at Sumitomo Mitsui Banking Corporation
↳ Knock-on damage from the Arara incident · View original incident227kImpact: Around 227,000 customer email addresses
Around 227,000 email addresses belonging to Sumitomo Mitsui Banking Corporation customers were leaked following unauthorised access to arara, its outsourced email delivery provider. No leak of account numbers or passwords has been confirmed.
Related reports: 12 · last report →Up to around 290,000 email addresses potentially leaked from Sakai City's online application system
↳ Knock-on damage from the Arara incident · View original incident290kImpact: Potential leak of up to around 290,000 email addresses
Up to around 290,000 email addresses may have been leaked from Sakai City's online application system in Japan. Unauthorised access occurred at Arara, which the city's contractor uses. Sakai City plans to investigate across all city council departments.
Read on Yahoo!ニュース ↗Arara hack raises fears of nearly 2 million Shogakukan member records leaking
↳ Knock-on damage from the Arara incident · View original incident2mImpact: Possible leak of 1,993,665 member records
A cyber-attack on Arara, Shogakukan’s distribution contractor, raised concerns that 1,993,665 member records, including Shogakukan IDs, may have been leaked. Separately, Shogakukan disclosed breaches exploiting vulnerabilities on two education and childcare websites and the possible leak of some member information. It logged all members out of the affected sites, reduced the information it retained and reported the incidents to the Personal Information Protection Commission.
Related reports: 5 · last report →Yokohama Rubber subscriber data leaked in Arara incident
↳ Knock-on damage from the Arara incident · View original incidentImpact: Company names and email addresses of news release and email newsletter subscribers exposed; the official announcement did not disclose the number of records
Unauthorised access to Arara's email distribution service exposed company names and email addresses registered by subscribers to Yokohama Rubber's news releases and email newsletters. Yokohama Rubber was notified of the unauthorised access on 28 October 2026 and suspended email distribution, then received notice on 3 November that its related data had been leaked and issued an announcement.
Read on 더구루 ↗Unauthorised access to Arara raises email leak concerns in Yaita
↳ Knock-on damage from the Arara incident · View original incidentUnauthorised access to email distribution provider Arara raised concerns that email addresses associated with the city of Yaita may have been exposed. On 13 November, it emerged that email addresses had been leaked in four cities and towns in Tochigi Prefecture. The specific scale of the damage in Yaita and details of its response have not been confirmed.
Related reports: 3 · last report →Unauthorised access to Arara exposes 5,192 TV Shin-Hiroshima users’ email addresses
↳ Knock-on damage from the Arara incident · View original incident5.2kImpact: Email addresses belonging to 5,192 people
Unauthorised access to Arara led to the exposure of email addresses belonging to 5,192 people using a service operated by TV Shin-Hiroshima. The precise date of the incident and subsequent response measures have not been confirmed.
Read on Yahoo!ニュース ↗Honjo warns of possible card appointment data leak following subcontractor breach
↳ Knock-on damage from the Arara incident · View original incidentImpact: Possible personal information leak
Unauthorised access took place between 28 and 31 October 2026 on arara message, a service run by arara, to which TKC, the contractor for Honjo’s My Number Card issuance appointment and management system, had subcontracted email delivery. Registered email addresses, names and other information may have been leaked, and whether any Honjo-related information was leaked and the extent of any such leak are still being investigated. In a follow-up notice on 10 November, the city said it had moved to a new email infrastructure and resumed sending appointment confirmation emails.
Read on 本庄市ホームページ ↗508 email addresses leaked from Yokohama facility booking system
↳ Knock-on damage from the Arara incident · View original incident508Impact: 508 email addresses exposed: 443 belonging to user organisations and 65 belonging to facilities
Unauthorised access to Arara's email delivery service exposed 508 email addresses associated with Yokohama's booking system for facilities including community care plazas: 443 belonging to user organisations and 65 belonging to facilities. The city was notified of the unauthorised access and service suspension on 28 October 2026, confirmed the scale of the leak on 9 November, and announced it on 10 November.
Read on Yahoo!ニュース ↗L’Arc-en-Ciel fan club email addresses exposed in Arara breach
↳ Knock-on damage from the Arara incident · View original incidentL’Arc-en-Ciel said on 10 November that fan club users’ email addresses had been leaked following a breach of the external email delivery service Arara Message. Those affected were people registered for the email service for paid members as of 31 October 2026, and email addresses were the only information confirmed to have been leaked. The operator, Fanplus, moved to a new email delivery system.
Read on Yahoo!ニュース ↗About 62,000 email addresses of Japan Cabinet Office newsletter users leaked
↳ Knock-on damage from the Arara incident · View original incident62kImpact: About 62,000 email addresses of newsletter users
Arara, the company contracted to distribute newsletters for Japan’s Cabinet Office, suffered unauthorised access, resulting in the leak of about 62,000 user email addresses. Other personal information, including names and occupations, may also have been leaked.
Related reports: 18 · last report →Unauthorised access to Arara exposes some Mitsubishi UFJ shareholders’ email addresses
↳ Knock-on damage from the Arara incident · View original incidentImpact: Email addresses of some shareholders
Unauthorised access to Arara exposed the email addresses of some Mitsubishi UFJ shareholders. The same incident also exposed the email addresses of some Nomura shareholders.
Read on 日本経済新聞 ↗Bank of Yokohama loan customer data leak affects up to 60,505 records
↳ Knock-on damage from the Arara incident · View original incident60.5kImpact: Up to 60,505 records belonging to some card loan and unsecured personal loan customers affected by the leak. The count may change following detailed investigation.
On 11 November, the Bank of Yokohama announced that a loan customer data leak confirmed on 5 November affected up to 60,505 records. The incident resulted from unauthorised access to the guarantee system of SMBC Consumer Finance, the guarantor for its card loans and unsecured personal loans, and is separate from the Arara incident. The number of affected records may change following further detailed investigation.
Read on カナロコ ↗125,788 customer email addresses exposed at five Kewpie Group companies
↳ Knock-on damage from the Arara incident · View original incident125.8kImpact: 125,788 customer email addresses
The breach of Arara’s email service also exposed 125,788 customer email addresses at five Kewpie Group companies. Those affected had received automated replies to campaign entries, enquiries and similar submissions, and the group suspended automated emails and began notifying them individually.
Read on SmartScope ↗Naha confirms 15,700 email addresses leaked in external email service cyber-attack
↳ Knock-on damage from the Arara incident · View original incident15.7kImpact: 15,700 user email addresses
The Japanese city of Naha said 15,700 user email addresses had been exposed through unauthorised access to Arara Message, an external email delivery service used by its online application system. This was a follow-up announcement on the incident in which unauthorised access was confirmed on 31 October 2026. It was confirmed that no other information, including email bodies, My Number identification numbers or application information, had been exposed.
Read on NHKニュース ↗Unauthorised access to Arara exposes 85,565 Tokyo Gas customer email addresses
↳ Knock-on damage from the Arara incident · View original incident85.6kImpact: 85,565 customer email addresses
Unauthorised access to Arara resulted in the leak of 85,565 email addresses belonging to Tokyo Gas customers. The impact on Tokyo Gas became known on 12 November.
Related reports: 4 →Akita Northern Happinets fan club data leak affects 41 members
↳ Knock-on damage from the Arara incident · View original incident41Impact: Personal information of 41 fan club members
Akita Northern Happinets announced the findings of an investigation into a fan club personal data leak reported to the team on 5 November. Unauthorised access to the system of arara, a subcontractor handling email distribution, exposed the email addresses of 41 members, including the names of two of them. No specific harm resulting from misuse of the leaked information has been confirmed.
Read on 日テレNEWS NNN ↗Arara breach leaks over 1.07 million Osaka administrative service email addresses
↳ Knock-on damage from the Arara incident · View original incident1.1mImpact: 1,078,713 email addresses belonging to users of the online administrative system, plus email addresses of users and participating merchants in a separate gift voucher programme
Unauthorised access to Arara’s external email distribution service resulted in the leak of 1,078,713 email addresses belonging to users of Osaka’s online administrative system. Email addresses of users and participating merchants in a separate gift voucher programme were also exposed. The City of Osaka urged residents to watch out for suspicious emails impersonating local authorities.
Related reports: 6 · last report →2,900 Sanfrecce Hiroshima customer email addresses leaked
↳ Knock-on damage from the Arara incident · View original incident2.9kImpact: 2,900 customer email addresses
A total of 2,900 email addresses belonging to customers of Sanfrecce Hiroshima's official mobile site were leaked. The leak was caused by unauthorised access to contractor Arara, and the club apologised.
Related reports: 4 →Over 35,600 registered Sasebo e Coin email addresses leaked
↳ Knock-on damage from the Arara incident · View original incident35.6kImpact: More than 35,600 registered email addresses leaked
Email addresses registered with the local currency service Sasebo e Coin were leaked as a result of unauthorised access to Arara Message. The leak was found to involve more than 35,600 addresses.
Related reports: 4 →Around 85,700 email addresses leaked from Kobe's electronic application system
↳ Knock-on damage from the Arara incident · View original incident85.7kImpact: Approximately 85,700 email addresses
Unauthorised access to Arara led to the leak of approximately 85,700 email addresses from the City of Kobe's electronic application system. The impact on Kobe was disclosed on 13 November.
Related reports: 3 →Hokkaido Electric Power reports 5,664 email addresses leaked in October Arara cyber-attack
↳ Knock-on damage from the Arara incident · View original incident5.7kImpact: 5,664 email addresses
Hokkaido Electric Power announced on 13 November that unauthorised access to the external email delivery service “Arara Message” between 27 and 31 October 2026 had exposed 5,664 customer email addresses from its e-commerce site “Kirameku Store”. Names, addresses, telephone numbers, passwords and credit card information were not exposed. The company disconnected its site from the service and advised customers to watch out for suspicious emails.
Read on 日本経済新聞 ↗
20 related reports
- Arara Says Hackers Took 3.01m Email Addresses From Its Mail Service
- 当社が提供する「アララメッセ－ジ」への不正アクセスによる情報流出およびサービス停止について
- arara: Approx. 3.01 Million Email Addresses Leaked via Unauthorized Access - Affected Companies and Notice Guide
- アララ 不正アクセス/メールアドレス流出
- アララのメール配信サービスが不正アクセスを受け約301万件のメールアドレスが流出
- 일본 이메일 발송 서비스 아라라 해킹당해 고객 이메일 주소 301만 건 유출
- Paycloud's Arara breach grows to about 77 million email addresses as service stays shut
- ペイクラウドＨＤ、不正アクセス被害拡大、メールアドレス約７７００万件に影響
- Arara breach expands from one mail system to 97 client servers
- ペイクラウドホールディングス傘下アララの情報流出、メアド約7700万件に拡大・サービス停止続く
- ペイクラウドHD、「アララ メッセージ」への不正アクセスで約7700万件のメールアドレスが流出
- 일본 기업용 이메일 발송 서비스 ‘아라라 메시지', 약 7,700만건 유출로 확대...380개사 피해
- Arara Says Email Service Breach Has Grown to About 77m Addresses
- メルアド7700万件流出か アララメッセージの不正アクセスで続報 共通環境から契約企業のサーバへ侵入 悪用も確認
- 「アララ」への不正アクセス影響 利用企業で情報漏えい相次ぐ
- Paycloud Holdings Data Breach: What Was Exposed
- 「アララ メッセージ」に不正アクセス、利用企業の環境などからメールアドレス 約8100万件（重複を除く）が持ち出された、メール配信は全面停止
- News - Arara Message hit by major data breach, exposing 77 million email addresses
- 日本ISP業者Arara遭駭，影響小學館、BIC Camera、摩斯漢堡等數百家客戶，可能外洩8,100萬筆資訊
- メール配信サービス「アララメッセージ」への不正アクセス、再開時期は未定
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.