Honjo warns of possible card appointment data leak after subcontractor breach
SpilloverSpillover from the Arara incident · View original incident →Unauthorized access occurred between October 28 and 31, 2026, on arara message, a service operated by arara, to which TKC, the contractor for Honjo’s My Number Card issuance appointment and management system, had subcontracted email delivery. Registered email addresses, names, and other information may have been leaked, and whether any Honjo-related information was leaked and the extent of any such leak remain under investigation. In a follow-up notice on November 10, the city said it had switched to a new email infrastructure and resumed sending appointment confirmation emails.
Key facts
- Affected organization
- City of Honjo
- Original incident
- Arara email service hack exposes 81.33 million email addresses
- Incident type
- Data breach
- Occurred / detected
- 2026-10-28
- Scale of damage
- Possible personal information leak
- Cause / method
- Unauthorized access involving the contractor for the My Number Card issuance appointment and management system
- Location
- Japan
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
Timeline
- Honjo issued its first follow-up notice on a possible personal information leak resulting from unauthorized access involving the system contractor.
Original incident
This is spillover from the Arara incident.
Arara email service hack exposes 81.33 million email addresses
81.3MImpact: 81,329,467 email addresses and some customers' member information
Japan's Arara Message email delivery service was breached through a web server vulnerability, exposing email addresses and some customers' member information. Further investigation put the number of unique email addresses exposed at 81,329,467. The attacker also abused the service to send up to approximately 7.13 million emails impersonating credit card companies, and the company isolated the servers and completely suspended its email delivery service.
Related reports: 20 · last report →
1 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.