Arara Message Breach: How One Email Vendor Exposed Millions of Addresses Across Japanese Brands

You trust your bank, your favourite shop, and your travel booking site. Behind their emails, many of them rely on the same specialist vendor to send messages in bulk. When that vendor is breached, the damage spreads across every brand it serves. That is what appears to have happened with Arara Message, a Japanese bulk email delivery service.

What was announced

On November 2, 2026, the operator's parent company, Paycloud Holdings, said that about 77 million email addresses had leaked from Arara Message because of unauthorized access in late October. The registered information of up to about 380 companies using the service was affected. According to the company, credit card numbers were not included, and up to about 7.13 million suspicious emails posing as a credit card company were sent after the intrusion.

The number moved as the investigation progressed. An earlier count, according to a report on the first announcement, was 61 companies and about 3.39 million unique email addresses. The later figure of about 77 million is described as potential exposure that is still being examined.

What clients have disclosed

Each client company has reported what it had stored in the service. Examples reported so far:

• Sumitomo Mitsui Banking Corporation: 227,216 email addresses of people who received its emails in a recent period, according to the bank's notice. The bank said it was first told that unauthorized access had occurred, with no leak confirmed at that point, and later that a leak was confirmed.
• Zaif, a crypto exchange: 380,536 customer email addresses.
• Asoview, a leisure and activity booking platform: 15,821,184 member records, including purchase histories according to a report.
• Other clients: more companies, including retailers, have disclosed affected customer or subscriber lists. Counts vary between sources and are still being refined, so check each company's own notice.

The data varied by client. It included names and email addresses, and, depending on the company, genders, dates of birth, phone numbers, membership IDs, and addresses.

How it happened, as far as is known

Arara first told some clients on October 28 that it had found unauthorized access but had no evidence of a leak, and confirmed the leak by November 2. Reports describe a third party reaching numerous servers through the service, with unauthorized logins to administrative screens and misuse of data-export functions. Arara said it invalidated authentication information that had been used illegally and blocked the related communications, and it halted the service on October 31. The full cause has not been disclosed.

The follow-on fraud

The email address is the key that phishers need. The suspicious messages reported with this incident posed as a credit card company. Reports describe them as sent from an address at the arara.com domain with subjects such as a request to confirm usage or a statement. The parent company urged caution about emails and phone calls claiming to come from Arara Message or from its client companies.

What to do

1. Do not click links in messages that mention card usage, statements, account confirmations, or deliveries, even when the sender name looks right.
2. Open the official app or type the address yourself to check any account issue.
3. Use a unique password for every service, with a password manager. See password manager in 20 minutes.
4. Turn on two-factor sign-in, especially for email, banking, and card accounts.
5. Watch your card statements, and enable transaction alerts.
6. If you clicked, follow what to do in the first hour.

If you have Japanese accounts and use a foreign card, see why Japanese websites reject foreign cards and fake delivery texts in Japan.

Lessons for businesses

• Vendor concentration is a risk. Ask your email vendor how admin access is protected, whether multi-factor authentication is required, and whether exports are limited and logged.
• Minimise what you load. A delivery tool needs addresses and a few fields, not every profile detail.
• Restrict admin access by IP address and role, and alert on bulk exports.
• Have a notification plan that covers the vendor's incidents, not only your own.
• Report on time. Japanese privacy law requires reporting certain breaches to the regulator and notifying affected people.

Sources

• Nippon.com / Jiji Press: 77 M. Email Addresses Leak from Arara Message Due to Cyberattack
• teiss: Arara Message hit by major data breach, exposing 77 million email addresses
• ASCII.jp: Arara, approximately 77 million email addresses leaked
• BigGo Finance: SMBC and Asoview disclosures related to Arara

Reported as of November 8, 2026. Counts are still changing; check the notice from each company.