ENKR

Arara Message email delivery service data breach

Add to my breach check

Made public

What leaked8

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Employer
  • Other profile data

Permanent

  • Date of birth
  • Full name
  • Gender
  • Date of birthonly where the client company registered it
  • Mobile numberphone number · type not stated; only where the client company registered it
  • Home or delivery addressonly where the client company registered it
  • Employercompany name in the customer data of five client companies
  • Full nameonly where the client company registered it
  • Genderonly where the client company registered it
  • Other profile datamember number and records of where mail was sent; only where the client company registered it

To-dos4 · about 50 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  3. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  4. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next22 events

  1. Undetected 2 events1 day · show events
  2. Response 20 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record
  1. Client SEGA said email addresses of 2.2 million subscribers of 11 newsletters were exposed, plus 92,300 records with other data still being determined
  2. Third report: 3,249,492 more email addresses taken from a separate cloud environment; 81,329,467 in total after removing duplicates
  3. Client Mos Food Services said 7,517,087 MOS WEB member records leaked, with no payment data
  4. Client Yokohama Rubber, first told it was not affected, announced that company names and email addresses of news-release subscribers leaked
  5. Client Asoview announced that 15,821,184 member records it sent through Arara Message leaked
17 more
  1. Client Shochiku Multiplex Theatres, which had said its members were not affected, announced that 3,320,305 SMT Members records leaked
  2. Asoview stopped all mail sent through Arara Message and disabled its admin password and API keys
  3. The three retailers said no secondary harm had been found as of 2 November
  4. Client retailers Bic Camera, Kojima and Sofmap announced that about 14.9 million newsletter records may have leaked
  5. Second report: about 77 million email addresses taken from client companies' servers · under review, with names and other member data for some; 3,386,187 addresses from the first system
  6. Stopped the whole Arara Message service · completed 19:53 JST; no date to resume
  7. Disabled the misused credentials and cut off the servers' connections
  8. Found that the attacker had also gone through the service into many more servers and taken database contents
  9. Cut off a second environment that was still being misused to send suspicious mail
  10. Reported to the police
  11. Filed a preliminary report with the Personal Information Protection Commission
  12. Apologised to end users, client companies and others
  13. First report on its company site, with the same count as the day before: about 3.01 million email addresses held by client companies were taken from one system
  14. Client service Paydon was the first user organisation to announce it was affected
  15. Emergency shutdown of the shared environment at 16:31 JST, after the attacker logged in to its admin screen and exported data
  16. Confirmed unauthorised access to part of its systems and took the server off the network
  17. Intrusion began
Company
Arara Message
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
about 77 million email addresses taken from the servers of up to about 380 client companies, including some that may have been taken · under review; one person can have several addresses, so not a count of people; operator's second report, November 2, 2026; a further 3,386,187 addresses from the shared environment in the first report, which may overlap

How the facts developed

  1. Second report: about 77 million email addresses, with names and other member data for some client companies, taken from up to about 380 client companies' servers; 3,386,187 addresses from the first system; up to about 7.13 million phishing emails posing as card companies were sent from the service between 28 and 30 October
  2. First report: about 3.01 million email addresses taken from one system, through a web server vulnerability

Sources