Now Hacked
EN-GB
Data breach

Bank of Yokohama loan customer data leak affects up to 60,505 records

First reported · Last reported · 1 related reports

SpilloverSpillover from the Arara incident · View original incident →

On 11 November, the Bank of Yokohama announced that a loan customer data leak confirmed on 5 November affected up to 60,505 records. The incident resulted from unauthorised access to the guarantee system of SMBC Consumer Finance, the guarantor for its card loans and unsecured personal loans, and is separate from the Arara incident. The number of affected records may change following further detailed investigation.

Key facts

Affected organisation
Bank of Yokohama
Original incident
Arara email service cyber-attack exposes 81.33 million email addresses
Incident type
Data breach
Occurred / detected
2026-11-05
Scale of damage
Up to 60,505 records belonging to some card loan and unsecured personal loan customers affected by the leak. The count may change following detailed investigation.
Cause / method
Unauthorised access related to the Arara incident
Location
Japan

If your data was exposed

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.

Timeline

  1. The data leak affecting some Bank of Yokohama loan customers was reported to involve more than 60,000 records at most.

Original incident

This is spillover from the Arara incident.

  • Data breachAraraKnock-on victims: 25

    Arara email service cyber-attack exposes 81.33 million email addresses

    81.3mImpact: 81,329,467 email addresses and some customers' member information

    Japan's Arara Message email delivery service was breached through a web server vulnerability, exposing email addresses and some customers' member information. Further investigation put the number of unique email addresses exposed at 81,329,467. The attacker also misused the service to send up to approximately 7.13 million emails impersonating credit card companies, and the company isolated the servers and suspended its email delivery service entirely.

    Related reports: 20 · last report →

1 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.