Arara email service hack exposes 81.33 million email addresses
Japan's Arara Message email delivery service was breached through a web server vulnerability, exposing email addresses and some customers' member information. Further investigation put the number of unique email addresses exposed at 81,329,467. The attacker also abused the service to send up to approximately 7.13 million emails impersonating credit card companies, and the company isolated the servers and completely suspended its email delivery service.
Key facts
- Affected organization
- Arara
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- 81,329,467 email addresses and some customers' member information
- Cause / method
- Exploitation of a web server vulnerability to breach customer servers through a shared environment
- Location
- Japan
If your data was exposed
Exposed dataEmailNamePhone numberAddressUsage & purchase history
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
Timeline
- The company disclosed the exposure of approximately 3.01 million email addresses, isolated the affected servers and suspended the service.
- The scope expanded to 97 servers in customer environments and up to approximately 380 companies, with an estimated 77 million email addresses affected.
- Investigators confirmed that customer servers had been breached through a shared environment and that up to approximately 7.13 million emails impersonating credit card companies had been sent.
- Additional data theft in another cloud environment was discovered, bringing the number of unique exposed addresses to 81,329,467.
- No date had been set for resuming the email delivery service.
- The exposure of 80,000 email addresses belonging to Kobe City became known.
Also affected by this incident
Asoview breach at service provider exposes 15,821,184 member records
↳ Knock-on damage from the Arara incident · View original incident15.8MImpact: 15,821,184 member records
Leisure booking service Asoview disclosed that 15,821,184 member records had been exposed following unauthorized access at Arara, its email delivery service provider. The exposed information included email addresses, names, phone numbers, last login dates, facilities used, and ticket purchase and cancellation histories, while the number of people affected has not been determined. Asoview said it had not entrusted passwords or payment card information to the provider.
Related reports: 2 →About 490,000 Solaseed Air customer email addresses leaked
↳ Knock-on damage from the Arara incident · View original incident490KImpact: About 490,000 customer email addresses
About 490,000 email addresses belonging to Solaseed Air customers were leaked externally. Unauthorized access to an external email system was confirmed as the cause, and Arara was identified as the system’s provider.
Related reports: 3 · last report →Arara email service breach exposes up to 2.23 million TKC user email addresses
↳ Knock-on damage from the Arara incident · View original incident2.2MImpact: Up to 2,230,812 user email addresses
Additional disclosures revealed that up to 2,230,812 email addresses belonging to users of TKC-operated systems were exposed through a breach of Arara’s email service. Investigators are examining whether information belonging to users of municipal online application services, including those in Yokohama and Kawasaki, was also affected.
Read on The Boston Report ↗Unauthorized access to Arara may have exposed up to 4,700 Fukushima personal data records
↳ Knock-on damage from the Arara incident · View original incident4.7KImpact: Potential leak of up to 4,700 personal data records
Unauthorized access to Arara was found to have potentially caused a personal data leak affecting the City of Fukushima as well. Up to 4,700 records may have been exposed.
Related reports: 2 · last report →About 227,000 customer email addresses leaked at Sumitomo Mitsui Banking Corporation
↳ Knock-on damage from the Arara incident · View original incident227KImpact: About 227,000 customer email addresses
About 227,000 email addresses belonging to Sumitomo Mitsui Banking Corporation customers were leaked after unauthorized access to arara, its outsourced email delivery provider. No leak of account numbers or passwords has been confirmed.
Related reports: 12 · last report →Up to around 290,000 email addresses potentially leaked from Sakai City's online application system
↳ Knock-on damage from the Arara incident · View original incident290KImpact: Potential leak of up to around 290,000 email addresses
Up to around 290,000 email addresses may have been leaked from Sakai City's online application system in Japan. Unauthorized access occurred at Arara, which the city's contractor uses. Sakai City plans to conduct an investigation across all city government departments.
Read on Yahoo!ニュース ↗Arara hack raises fears of nearly 2 million Shogakukan member records leaking
↳ Knock-on damage from the Arara incident · View original incident2MImpact: Possible leak of 1,993,665 member records
A cyberattack on Arara, Shogakukan’s distribution contractor, raised concerns that 1,993,665 member records, including Shogakukan IDs, may have been leaked. Separately, Shogakukan disclosed breaches exploiting vulnerabilities on two education and childcare websites and the possible leak of some member information. It logged all members out of the affected sites, reduced the information it retained, and reported the incidents to the Personal Information Protection Commission.
Related reports: 5 · last report →Yokohama Rubber subscriber data leaked in Arara incident
↳ Knock-on damage from the Arara incident · View original incidentImpact: Company names and email addresses of news release and email newsletter subscribers exposed; the official announcement did not disclose the number of records
Unauthorized access to Arara's email distribution service exposed company names and email addresses registered by subscribers to Yokohama Rubber's news releases and email newsletters. Yokohama Rubber was notified of the unauthorized access on October 28, 2026, and suspended email distribution, then received notice on November 3 that its related data had been leaked and issued an announcement.
Read on 더구루 ↗Unauthorized access to Arara raises email leak concerns in Yaita
↳ Knock-on damage from the Arara incident · View original incidentUnauthorized access to email distribution provider Arara raised concerns that email addresses associated with the city of Yaita may have been exposed. On November 13, it emerged that email addresses had been leaked in four cities and towns in Tochigi Prefecture. The specific scale of the damage in Yaita and details of its response have not been confirmed.
Related reports: 3 · last report →Unauthorized access to Arara exposes 5,192 TV Shin-Hiroshima users’ email addresses
↳ Knock-on damage from the Arara incident · View original incident5.2KImpact: Email addresses belonging to 5,192 people
Unauthorized access to Arara resulted in the exposure of email addresses belonging to 5,192 people using a service operated by TV Shin-Hiroshima. The exact date of the incident and subsequent response measures have not been confirmed.
Read on Yahoo!ニュース ↗Honjo warns of possible card appointment data leak after subcontractor breach
↳ Knock-on damage from the Arara incident · View original incidentImpact: Possible personal information leak
Unauthorized access occurred between October 28 and 31, 2026, on arara message, a service operated by arara, to which TKC, the contractor for Honjo’s My Number Card issuance appointment and management system, had subcontracted email delivery. Registered email addresses, names, and other information may have been leaked, and whether any Honjo-related information was leaked and the extent of any such leak remain under investigation. In a follow-up notice on November 10, the city said it had switched to a new email infrastructure and resumed sending appointment confirmation emails.
Read on 本庄市ホームページ ↗508 email addresses leaked from Yokohama facility booking system
↳ Knock-on damage from the Arara incident · View original incident508Impact: 508 email addresses exposed: 443 belonging to user organizations and 65 belonging to facilities
Unauthorized access to Arara's email delivery service exposed 508 email addresses associated with Yokohama's booking system for facilities including community care plazas: 443 belonging to user organizations and 65 belonging to facilities. The city was notified of the unauthorized access and service suspension on October 28, 2026, confirmed the scale of the leak on November 9, and announced it on November 10.
Read on Yahoo!ニュース ↗L’Arc-en-Ciel fan club email addresses leaked in Arara breach
↳ Knock-on damage from the Arara incident · View original incidentL’Arc-en-Ciel announced on November 10 that fan club users’ email addresses had been leaked following a breach of the external email delivery service Arara Message. Those affected were subscribers to the email service for paid members as of October 31, 2026, and email addresses were the only information confirmed to have been leaked. The operator, Fanplus, switched to a new email delivery system.
Read on Yahoo!ニュース ↗About 62,000 email addresses of Japan Cabinet Office newsletter users leaked
↳ Knock-on damage from the Arara incident · View original incident62KImpact: About 62,000 email addresses of newsletter users
Arara, the company contracted to distribute newsletters for Japan’s Cabinet Office, suffered unauthorized access, resulting in the leak of about 62,000 user email addresses. Other personal information, including names and occupations, may also have been leaked.
Related reports: 18 · last report →Unauthorized access to Arara exposes some Mitsubishi UFJ shareholders’ email addresses
↳ Knock-on damage from the Arara incident · View original incidentImpact: Email addresses of some shareholders
Unauthorized access to Arara exposed the email addresses of some Mitsubishi UFJ shareholders. The same incident also exposed the email addresses of some Nomura shareholders.
Read on 日本経済新聞 ↗Bank of Yokohama loan customer data leak affects up to 60,505 records
↳ Knock-on damage from the Arara incident · View original incident60.5KImpact: Up to 60,505 records belonging to some card loan and unsecured personal loan customers affected by the leak. The count may change following detailed investigation.
On November 11, the Bank of Yokohama announced that a loan customer data leak confirmed on November 5 affected up to 60,505 records. The incident resulted from unauthorized access to the guarantee system of SMBC Consumer Finance, the guarantor for its card loans and unsecured personal loans, and is separate from the Arara incident. The number of affected records may change following further detailed investigation.
Read on カナロコ ↗125,788 customer email addresses exposed at five Kewpie Group companies
↳ Knock-on damage from the Arara incident · View original incident125.8KImpact: 125,788 customer email addresses
The breach of Arara’s email service also exposed 125,788 customer email addresses at five Kewpie Group companies. Those affected had received automated replies to campaign entries, inquiries and similar submissions, and the group suspended automated emails and began notifying them individually.
Read on SmartScope ↗Naha confirms 15,700 email addresses leaked in external email service hack
↳ Knock-on damage from the Arara incident · View original incident15.7KImpact: 15,700 user email addresses
The Japanese city of Naha said 15,700 user email addresses had been exposed through unauthorized access to Arara Message, an external email delivery service used by its online application system. This was a follow-up announcement on the incident in which unauthorized access was confirmed on October 31, 2026. It was confirmed that no other information, including email bodies, My Number identification numbers or application information, had been exposed.
Read on NHKニュース ↗Unauthorized access to Arara exposes 85,565 Tokyo Gas customer email addresses
↳ Knock-on damage from the Arara incident · View original incident85.6KImpact: 85,565 customer email addresses
Unauthorized access to Arara resulted in the leak of 85,565 email addresses belonging to Tokyo Gas customers. The impact on Tokyo Gas became known on November 12.
Related reports: 4 →Akita Northern Happinets fan club data leak affects 41 members
↳ Knock-on damage from the Arara incident · View original incident41Impact: Personal information of 41 fan club members
Akita Northern Happinets announced the findings of an investigation into a fan club personal data leak reported to the team on November 5. Unauthorized access to the system of arara, a subcontractor handling email distribution, exposed the email addresses of 41 members, including the names of two of them. No specific harm resulting from misuse of the leaked information has been confirmed.
Read on 日テレNEWS NNN ↗Arara breach leaks over 1.07 million Osaka administrative service email addresses
↳ Knock-on damage from the Arara incident · View original incident1.1MImpact: 1,078,713 email addresses belonging to users of the online administrative system, plus email addresses of users and participating merchants in a separate gift certificate program
Unauthorized access to Arara’s external email distribution service resulted in the leak of 1,078,713 email addresses belonging to users of Osaka’s online administrative system. Email addresses of users and participating merchants in a separate gift certificate program were also exposed. The City of Osaka urged residents to watch out for suspicious emails impersonating local governments.
Related reports: 6 · last report →2,900 Sanfrecce Hiroshima customer email addresses leaked
↳ Knock-on damage from the Arara incident · View original incident2.9KImpact: 2,900 customer email addresses
A total of 2,900 email addresses belonging to customers of Sanfrecce Hiroshima's official mobile site were leaked. The leak resulted from unauthorized access to contractor Arara, and the club apologized.
Related reports: 4 →Over 35,600 registered Sasebo e Coin email addresses leaked
↳ Knock-on damage from the Arara incident · View original incident35.6KImpact: More than 35,600 registered email addresses leaked
Email addresses registered with the local currency service Sasebo e Coin were leaked as a result of unauthorized access to Arara Message. The leak was found to involve more than 35,600 addresses.
Related reports: 4 →About 85,700 email addresses leaked from Kobe's electronic application system
↳ Knock-on damage from the Arara incident · View original incident85.7KImpact: Approximately 85,700 email addresses
Unauthorized access to Arara resulted in the leak of approximately 85,700 email addresses from the City of Kobe's electronic application system. The impact on Kobe was disclosed on November 13.
Related reports: 3 →Hokkaido Electric Power reports 5,664 email addresses leaked in October Arara hack
↳ Knock-on damage from the Arara incident · View original incident5.7KImpact: 5,664 email addresses
Hokkaido Electric Power announced on November 13 that unauthorized access to the external email delivery service “Arara Message” between October 27 and 31, 2026, had exposed 5,664 customer email addresses from its e-commerce site “Kirameku Store.” Names, addresses, phone numbers, passwords, and credit card information were not exposed. The company disconnected its site from the service and advised customers to watch out for suspicious emails.
Read on 日本経済新聞 ↗
20 related reports
- Arara Says Hackers Took 3.01m Email Addresses From Its Mail Service
- 当社が提供する「アララメッセ－ジ」への不正アクセスによる情報流出およびサービス停止について
- arara: Approx. 3.01 Million Email Addresses Leaked via Unauthorized Access - Affected Companies and Notice Guide
- アララ 不正アクセス/メールアドレス流出
- アララのメール配信サービスが不正アクセスを受け約301万件のメールアドレスが流出
- 일본 이메일 발송 서비스 아라라 해킹당해 고객 이메일 주소 301만 건 유출
- Paycloud's Arara breach grows to about 77 million email addresses as service stays shut
- ペイクラウドＨＤ、不正アクセス被害拡大、メールアドレス約７７００万件に影響
- Arara breach expands from one mail system to 97 client servers
- ペイクラウドホールディングス傘下アララの情報流出、メアド約7700万件に拡大・サービス停止続く
- ペイクラウドHD、「アララ メッセージ」への不正アクセスで約7700万件のメールアドレスが流出
- 일본 기업용 이메일 발송 서비스 ‘아라라 메시지', 약 7,700만건 유출로 확대...380개사 피해
- Arara Says Email Service Breach Has Grown to About 77m Addresses
- メルアド7700万件流出か アララメッセージの不正アクセスで続報 共通環境から契約企業のサーバへ侵入 悪用も確認
- 「アララ」への不正アクセス影響 利用企業で情報漏えい相次ぐ
- Paycloud Holdings Data Breach: What Was Exposed
- 「アララ メッセージ」に不正アクセス、利用企業の環境などからメールアドレス 約8100万件（重複を除く）が持ち出された、メール配信は全面停止
- News - Arara Message hit by major data breach, exposing 77 million email addresses
- 日本ISP業者Arara遭駭，影響小學館、BIC Camera、摩斯漢堡等數百家客戶，可能外洩8,100萬筆資訊
- メール配信サービス「アララメッセージ」への不正アクセス、再開時期は未定
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.