Japan | November 6, 2026 | Data breach and phishing operation
The Arara Message data breach has expanded to a confirmed count of 81,329,467 email addresses after Japan-based email delivery provider Arara disclosed a third incident update on November 6. The company said the total represents email addresses taken from several affected environments after removing duplicates between the reported categories. It does not represent 81 million individual people.
The incident affected Arara Message, a business email distribution platform used by companies to send communications to customers and members. Investigators identified unauthorized access involving 97 servers and estimated that as many as 380 client companies may have been affected. Attackers also abused parts of the service to send up to 7.13 million suspicious emails impersonating credit-card companies.
The latest disclosure adds another 3.24 million email addresses from a separate cloud environment, bringing the deduplicated total above 81 million. Arara says the additional data was taken during the same intrusion period between October 28 and 31, rather than through a newly identified attack. The service remains suspended, and the company has not announced a date for restoring it.
The case demonstrates how a compromise of a third-party communications provider can expose data belonging to many organizations and turn a trusted email channel into a tool for phishing.
Arara Message Data Breach Reaches 81.3 Million Addresses
Arara’s November 6 report revised the scale of the incident after investigators identified data taken from a cloud environment that had not been included in the company’s November 2 update.
The newly identified environment contained 3,249,492 email addresses. Arara said attackers accessed it using improperly used authentication credentials between October 28 and 31. The company disabled those credentials and stopped the affected environment on October 31.
When the new figure was combined with the previously reported categories and duplicate addresses were removed, the total reached 81,329,467 email addresses. The company also revised one earlier category: the number of addresses associated with its previously disclosed shared environment was adjusted from 3,386,187 to 2,842,400.
These revisions matter because the figures describe overlapping datasets. Simply adding every number from the earlier announcements would overstate the total. Arara’s latest consolidated figure is the appropriate number to use when describing the reported email-address exposure.
The company divided the total into two broad categories: addresses without additional attributes and addresses associated with other registered information. Its report lists 34,285,087 addresses in the email-only category and 47,044,380 in the category containing email addresses and additional attributes. Arara said the detailed breakdown was still being examined.
The distinction between addresses and people is especially important. One person may use multiple email addresses, and the same address may appear in more than one customer environment. Although Arara removed identified overlap between the categories, the figure should not be presented as a count of unique victims.
How Attackers Reached Arara’s Customer Environments
The incident developed across more than one part of the company’s infrastructure.
In its November 2 report, Paycloud Holdings, Arara’s parent company, said attackers had accessed servers connected to the email-delivery service and moved from those systems into customer environments. The company identified 97 servers and estimated that the affected customer-company count could reach approximately 380.
The reported activity included unauthorized access to a shared environment and subsequent access through Arara Message infrastructure to customer environments. The company said attackers accessed databases and removed information. Depending on the customer and system, the affected data could include email addresses and registered membership information.
Arara’s first public explanation referred to exploitation of a web-server vulnerability. The November 2 update added that problems in the system environment also contributed to the incident. The company has not publicly identified a CVE, provided a complete technical attack chain or attributed the intrusion to a named threat group.
The November 6 update described another cloud environment, separate from the environments covered in the earlier report. In that case, attackers used authentication credentials without authorization to access the environment and remove email addresses. Arara said the new finding belonged to the same October 28–31 period and did not represent a separate new intrusion.
The distinction is important. The disclosures show that the investigation expanded its understanding of the incident’s scope; they do not establish that a new attack began on November 6.
What Information Was Exposed?
The type of information involved differed across customer environments.
Arara said some affected datasets contained email addresses alongside customer attributes registered by client companies. Depending on the organization, those fields could include names, gender, dates of birth, telephone numbers, membership numbers, company names and residential addresses.
The company’s November 6 report also identified a separate environment from which the data taken consisted of email addresses only. This means it would be inaccurate to claim that every one of the 81.3 million addresses was accompanied by names, phone numbers or other personal details.
In its November 2 disclosure, Paycloud said that customer data from five client companies could include up to 411,827 records containing names, company names and other information. The company also reported 3,386,187 email addresses in the shared environment at that stage; the November 6 update subsequently revised that category to 2,842,400.
Arara said its service did not hold credit-card numbers. That statement is relevant to the scope of the service’s stored information, but it does not eliminate the risk of financial fraud. Email addresses and other personal details can still be used to make fraudulent messages more convincing or to support attempts to impersonate businesses.
The Arara Message data breach therefore presents different levels of potential exposure depending on which customer environment was involved. Affected organizations need to determine exactly which fields were stored in their own environment rather than assuming that every client experienced the same disclosure.
Attackers Abused the Service to Send Millions of Phishing Emails
The incident involved more than data removal. Attackers also misused Arara’s email-delivery infrastructure to distribute suspicious messages.
According to Paycloud’s November 2 report, up to approximately 7.13 million emails were sent between October 28 and 30 from two affected environments. The messages impersonated credit-card companies and used subject lines asking recipients to confirm account activity or review billing statements.
The messages were sent using the address news@arara.com. Their subject lines included Japanese wording equivalent to requests for confirmation of usage details and billing statements.
The company said the messages were sent to email addresses brought into the service by a third party, rather than simply to the existing mailing lists of Arara’s customers. It reported that suspicious sending stopped after the affected environments were blocked, with no new messages observed after October 30 at 13:32 Japan time.
This detail makes the incident particularly concerning. A compromised bulk-mail platform can provide attackers with access to an established sending channel. Messages originating from a familiar service or domain may appear more credible than messages sent from newly created accounts.
Recipients who recognize a company’s name or have previously received legitimate communications through a platform may be more likely to open a message or follow a link. An email that appears to concern a card statement, payment or account review can create pressure to act quickly.
The company warned users not to open unexpected links, download attachments or provide passwords and payment details in response to suspicious communications. Anyone who entered card details on a link received through one of the fraudulent messages should contact their card issuer.
Why the Incident Affects More Than One Organization
Arara Message is a third-party email distribution service. Businesses use platforms of this kind to send newsletters, membership notifications, customer updates and other communications without operating their own bulk-mail infrastructure.
This arrangement can make routine communication more efficient, but it also creates a concentration of risk. A single provider may hold information associated with customers of many otherwise unrelated businesses. If an attacker gains access to the provider’s systems or connected customer environments, the consequences can extend across multiple organizations.
The Arara Message data breach illustrates this dependency. The company’s November 2 estimate put the potential number of client companies at up to approximately 380, while its latest update added another cloud environment to the reported scope. The company has not published a complete final list of affected organizations or confirmed that every estimated client suffered the same type of data loss.
For customers, the incident can also create confusion about who is responsible for providing notifications and guidance. A person may have registered with a retailer, membership program, utility provider or other organization without knowing that an external email platform was handling communications.
Organizations using the service must therefore work with the provider to establish whether their own data was affected, what information was involved and which users need to be notified. They also need to consider whether messages sent through the service during the incident period were legitimate.
Service Shutdown and Investigation Remain Ongoing
Arara said it stopped the Arara Message service on October 31. The November 2 report stated that the shutdown was completed at 19:53 Japan time. The company has not announced a restoration date.
Before resuming service, Arara said it would need to identify the intrusion route, change authentication credentials comprehensively and verify the safety of the system. It also said customers would be asked to reset administrative passwords and authentication information, including API keys, when service resumes.
The company has been working with external specialists to investigate the incident and strengthen its security arrangements. Its November 6 report said it had made or planned additional reports to Japan’s Personal Information Protection Commission and other relevant organizations. It had also notified police.
Some customers have begun restoring their own email functions through alternative systems. For example, TKC said on November 6 that it was rebuilding its email-sending infrastructure and gradually restoring selected functions after conducting safety checks. This is a separate recovery measure by a customer organization, not confirmation that Arara Message itself has resumed operation.
The interruption may affect routine business communications, including account notices, service updates and customer messages. Organizations that depend on the platform need to ensure that replacement systems are secure and that users can distinguish legitimate communications from fraudulent ones.
What Businesses and Users Should Do Now
Organizations that used Arara Message should establish whether their account, customer environment or data was included in the incident. They should obtain written confirmation from the provider, identify the information involved and assess whether their own customers require notification under applicable privacy and data-protection obligations.
They should also review administrator credentials, API keys, access permissions and any systems that exchanged data with the affected service. Credentials that were stored, transmitted or used in the affected environments should be reviewed and rotated where appropriate. Businesses should verify that replacement email infrastructure is independently secured before resuming customer communications.
For individuals, the most immediate concern is phishing. An exposed email address can be targeted with fraudulent messages, while additional personal information may help criminals make those messages appear more convincing.
Users should be cautious of unexpected emails claiming to come from banks, credit-card companies, retailers or membership services. They should avoid opening links or attachments in unsolicited messages and should not enter login or payment details through a link received by email. Instead, they should visit the organization’s official website directly or use a trusted customer-service channel.
Anyone who received a suspicious message from news@arara.com between October 28 and 30 should follow the company’s warning and delete it without opening its links. People who supplied financial information through one of those messages should contact their financial institution promptly.
A Major Third-Party Security Failure With a Wider Impact
The latest disclosure makes the Arara Message data breach one of the most significant email-address exposure incidents reported in Japan in recent weeks. Its scale is substantial, but the numbers require careful interpretation: 81,329,467 is the company’s deduplicated count of email addresses, not a verified count of individual people.
The incident also highlights a broader security challenge. Organizations can invest in protecting their own networks and customer databases while remaining exposed through external platforms that process information on their behalf. A supplier’s access controls, server configuration, credential management and incident response can become part of every customer’s security posture.
Arara’s November 6 update provides a more complete picture of the data taken, but important questions remain. The company has not announced a restoration date, published a complete list of affected clients or disclosed a full technical explanation of the intrusion. The final impact on customers and the provider’s business also remains under review.
For now, the incident is a reminder that third-party services must be treated as part of an organization’s security perimeter. The consequences of a compromise can extend well beyond the provider itself, particularly when a trusted communications platform is turned into a channel for phishing.
Source note: This report draws on incident disclosures from Arara Inc., Paycloud Holdings, TKC Group and affected customer organizations, alongside reporting by The Japan Times and Impress Watch. Figures reflect Arara’s November 6 update. The company describes the 81,329,467 figure as email addresses, not individual people; the detailed information exposed varies by environment and customer.
NewsFlayer — Your trusted source for cybersecurity news, digital threats and technology developments.