Arara now says about 77 million email addresses were taken, plus names and birth dates for some

On October 29 we wrote that Arara, the Japanese company behind the Arara Message newsletter service, had lost about 3.01 million email addresses. On November 2, 2026, it published a second report that is much larger. If a company or group in Japan sends you email newsletters, here’s what changed.

What happened

According to Arara’s second report (in Japanese, PDF), the attacker didn’t stop at the shared system Arara first described. Between October 28 and 31, the attacker went through an Arara Message server into 97 servers that hold client companies’ own setups, and copied out the contents of their databases. Arara counts about 77 million email addresses taken from those servers so far. It estimates up to about 380 client companies are involved, and it says the count is still being checked and may change. One person can have more than one address, so it isn’t a count of people.

This time it isn’t only email addresses. Depending on what each client company stored in the service, the copied data includes:

• email address
• name
• gender
• date of birth
• phone number
• member number
• home address
• records of which mailings were sent to whom

Arara says the service never holds credit card numbers. Nikkei (in Japanese) reported that Arara’s parent company, Paycloud Holdings, announced the same figure of about 77 million addresses.

Arara also updated its first count. From the shared system, the attacker took 3,386,187 email addresses (after removing duplicates) tied to 61 client companies, and up to 411,827 customer records with names and company names stored by five of them. The attacker logged in to that system’s admin screen on October 27 and 28 and used its export features. Arara now says the cause was a web server vulnerability together with problems in how its systems were set up. It hasn’t said yet when or how the intrusion began.

Phishing sent from Arara’s own service

The second report also confirms that the attacker used Arara Message itself to send up to about 7.13 million fake emails between October 28 and 30. They came from news@arara.com, pretended to be from a credit card company and used subjects like 「利用内容確認のご依頼」 and 「ご利用明細確認のご依頼」 (requests to confirm your card use or statement). Arara says the recipients were addresses the attacker brought in from outside, and it hasn’t found anything beyond email addresses leaking from the sending itself. It says the last one went out at 1:32 p.m. on October 30, Japan time. If you got one, delete it and don’t open the link. If you entered card details on the linked page, call your card issuer right away.

Arara stopped the whole service on October 31 and hasn’t said when it will restart. It says it will tell every client company whether its setup was affected. Client companies have started telling their own users. JERA, for example, said about 110,000 email addresses of people who used its JERA Sunday movie discount service may have leaked (in Japanese) from an outside service it uses, and warned about the same news@arara.com emails.

What this means for you

You may never have heard of Arara, but around 380 companies may have used it to email their members. If one of them was yours, your email address and possibly your name, birth date, phone number and address are now in someone else’s hands. That makes the next scam message easier to write. It may know your name and appear to come from a shop or club you actually belong to.

What you can do

1. Watch for a notice from companies and groups that email you in Japan. Arara is telling its client companies first, and they decide how to tell their members.
2. Delete any email from news@arara.com about confirming card use or a statement. If you entered card details, call your card issuer.
3. Go to the company’s site or app yourself if a message asks you to sign in, pay or confirm your details.
4. Never give out passwords, card numbers or verification codes to someone who contacts you, even if they know your name and birth date.
5. Learn the patterns. See how scammers use leaked data.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each newsletter its own address, so you can tell which list leaked and turn that address off. Frame never collects or stores the leaked records themselves.

Sources

• Arara, 当社が提供する「アララメッセ－ジ」への不正アクセスによる情報流出およびサービス停止について（第２報） (in Japanese, PDF), November 2, 2026
• Nikkei, メール配信「アララ」で不正アクセス、最大713万通の不審メール確認 (in Japanese), November 2, 2026
• JERA, 映画割引サービス「JERAサンデイ」で利用する外部サービスにおける情報流出の可能性（続報） (in Japanese), November 2, 2026
• Arara, 当社が提供する「アララメッセ－ジ」への不正アクセスによる情報流出およびサービス停止について (in Japanese), October 29, 2026