Breach · 6 min read
Arara breach: Bic Camera says about 14.9 million records, and SMBC, GMO and Edogawa City tell customers
More companies that sent email through Arara Message have named their share of the leak, from Bic Camera’s mailing lists to a city’s My Number card booking emails.
The list of companies caught up in the breach at Arara, the Japanese company behind the Arara Message email service, keeps growing. Arara says about 77 million email addresses were taken from servers used by up to about 380 client companies. Yesterday we went through what Asoview, IIJmio, TKC, Workman and others had told their customers. Since then, electronics retailer Bic Camera, the bank SMBC, a payments company, an events company and a Tokyo city ward have published their own notices. If you deal with any of them, here’s what each has said.
Bic Camera group: about 14.9 million records
On November 2, Bic Camera and its group companies Kojima and Sofmap published a joint notice (in Japanese, PDF) saying that details of people signed up for their email newsletters may have leaked through Arara’s system. The three companies put the total at about 14.9 million records, covering “customer email addresses, etc.” ITmedia (in Japanese) and Kyodo, via the Mainichi, reported it on November 4.
The notice says credit card details and the login details for the companies’ online stores weren’t handled by the service, so they aren’t part of this. The group has stopped sending data to the service, is working with Arara to pin down who is affected, and says each company will contact its own affected customers. It says no secondary harm has been confirmed so far and asks customers to be wary of emails pretending to be from the group or from Arara.
SMBC: 227,216 email addresses
Sumitomo Mitsui Banking Corporation, one of Japan’s largest banks, said on November 5 that 227,216 email addresses it used for mailings had leaked (English notice, PDF). It uses Arara Message mainly for emails to corporate customers, and for some emails to sole proprietors. Its timeline is a useful look at how the picture changed:
- October 28: Arara told SMBC about the unauthorized access, and said its log review had found no sign of a leak.
- November 2: Arara told SMBC that further investigation had confirmed SMBC’s mailing addresses had leaked.
SMBC says the leaked data is limited to the email addresses of people it emailed between July 1 and October 31, 2026, and doesn’t include account numbers, balances, PINs, internet banking IDs or passwords. It will report the incident to the authorities, and it has opened a Japanese-language helpline until November 30. Customers outside Japan are asked to contact their relationship manager or customer service team. The bank says it will never ask for passwords or card details by email.
Other notices from November 5
| Organization | What leaked | Count |
|---|---|---|
| GMO Payment Service (payments company) | Details of people emailed between July 20 and October 30 by a law firm it contracts, which used Arara Message. Most records are email addresses only; a smaller group also included names, amounts billed, what was billed (store and item), inquiry numbers and notice content. | Up to 106,997, of which up to 5,771 with the extra details |
| Congre (events and venues, including the IMAGINUS science centre and TAKANAWA GATEWAY Convention Center) | Email addresses only. Congre says names, company names, phone numbers, passwords and payment details weren’t in the leak. | 39,144 |
| Edogawa City (Tokyo ward) | Possibly the email addresses of people who booked online to pick up their My Number card. The ward’s contractor is still checking whether its data was in the leak. | Not yet known |
All of these say the leak happened at Arara or at a contractor using Arara, not in their own systems. GMO Payment Service and Congre say they will email the people affected. As with yesterday’s list, these counts may overlap with each other and with Arara’s own total, so they can’t be added up.
What this means for you
For most people on these lists, what leaked is an email address tied to a shop, bank or service they really use. That’s enough to make a phishing email look right. The GMO Payment Service records with names and billing details go further: a scammer could quote a real purchase and a real amount owed, which makes a fake payment demand much easier to believe.
Edogawa City’s notice also sets out the timeline: the break-in at Arara on October 27, up to about 7.13 million fake credit card emails sent from news@arara.com starting October 28, and the service shut down on October 31. Arara Message is still offline.
What you can do
- Be extra careful with emails that mention payments, refunds, account problems or ID checks from Bic Camera, Kojima, Sofmap, SMBC, GMO Payment Service or the others above. Open the app or type the address yourself.
- If an email asks you to pay a bill, check it another way. Look up the bill in the original store’s account or contact the company using details from its website, not the email.
- Never give a password, PIN, card number or verification code to someone who contacts you. SMBC, Edogawa City and the others say they never ask for these by email or phone.
- Delete emails from news@arara.com without clicking anything.
- Watch for an individual notice from the company if you’re affected.
- Learn the patterns. See how scammers use leaked data to make phishing personal.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each newsletter and shop its own address, so you can tell which list leaked and turn that address off. Frame never collects or stores the leaked records themselves.
Related coverage
- Arara breach: Asoview says 15.8 million member records leaked, and more companies name their counts: the first round of client company notices, from November 3 and 4.
- Arara now says about 77 million email addresses were taken: Arara’s second report, which these notices follow from.
- Arara Message: about 3.01 million email addresses taken: the first report, from October 29.
- SMBC Consumer Finance says up to 320,118 loan customers’ data left its guarantee system: a separate incident, at a company in the same financial group as SMBC, not related to Arara.
Sources
- Bic Camera, Kojima and Sofmap, 業務委託先への不正アクセスによるメールマガジン登録のお客様情報漏えいに関するお詫びとお知らせ (in Japanese, PDF), November 2, 2026
- ITmedia NEWS, ビックカメラG、メールアドレスなど約1490万件漏えいの可能性 委託先への不正アクセスで (in Japanese), November 4, 2026
- The Mainichi (Kyodo), Nomura subsidiary, retailer Bic Camera among latest affected by data breach, November 4, 2026
- Sumitomo Mitsui Banking Corporation, Information Leakage Following Unauthorized Access to a Third-Party Email Distribution Service (PDF), November 5, 2026
- GMO Payment Service, アララ株式会社で発生した不正アクセスに伴う個人情報の漏洩について (in Japanese), November 5, 2026
- Congre, メール配信サービス「アララメッセージ」への不正アクセスによるメールアドレス流出に関するお詫びとお知らせ (in Japanese), November 5, 2026
- Edogawa City, 区の委託事業における個人情報漏えいの可能性 (in Japanese), November 5, 2026
More stories
- BreachDocomo says data on up to 294,839 phone lines was taken through My docomo, including ID document numbers · 6 min read
- BreachM1 says customer names, NRIC details and addresses were taken in an October 30 breach · 5 min read
- BreachMUJI now says full card numbers of about 1.09 million MUJI Card holders may have been reached · 5 min read
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.