ENKR

Arara Message email delivery service data breach

Add to my breach check

Made public

What leaked8

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Employer
  • Other profile data

Permanent

  • Date of birth
  • Full name
  • Gender
  • Date of birthonly where the client company registered it
  • Mobile numberphone number · type not stated; only where the client company registered it
  • Home or delivery addressonly where the client company registered it
  • Employercompany name in the customer data of five client companies
  • Full nameonly where the client company registered it
  • Genderonly where the client company registered it
  • Other profile datamember number and records of where mail was sent; only where the client company registered it

To-dos4 · about 50 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  3. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  4. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next22 events

  1. Undetected 2 events1 day · Back to latest
  2. Response 20 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record

Undetected: 2 events

Back to latest
  1. Confirmed unauthorised access to part of its systems and took the server off the network
  2. Intrusion began
Company
Arara Message
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
about 77 million email addresses taken from the servers of up to about 380 client companies, including some that may have been taken · under review; one person can have several addresses, so not a count of people; operator's second report, November 2, 2026; a further 3,386,187 addresses from the shared environment in the first report, which may overlap

How the facts developed

  1. Second report: about 77 million email addresses, with names and other member data for some client companies, taken from up to about 380 client companies' servers; 3,386,187 addresses from the first system; up to about 7.13 million phishing emails posing as card companies were sent from the service between 28 and 30 October
  2. First report: about 3.01 million email addresses taken from one system, through a web server vulnerability

Sources