Breach · · 3 min read
Arara Message: about 3.01 million email addresses taken from a Japanese newsletter service
Arara, whose Arara Message service sends newsletters for Japanese companies and groups, says about 3.01 million email addresses were taken. Expect more suspicious email.
Arara Message is an email delivery service that Japanese companies and organizations use to send newsletters and notices to their members. Arara, the company behind it, says an attacker took about 3.01 million email addresses from one of its systems. You may never have heard of Arara, but a group you get email from may use it. Here’s what is known and what to watch for.
What happened
Arara says it confirmed unauthorized access to part of its systems on October 28, 2026, cut the affected server off from the network and suspended the service, according to its notice (in Japanese) published on October 29. It says about 3.01 million email addresses, held by the client companies that use that system, were taken. The cause it gives is a vulnerability in a web server.
Arara’s parent company, Paycloud Holdings, filed the same figure in an investor disclosure and said measures to strengthen security will follow, Japan IR reported. NHK (in Japanese) reported that email delivery has been stopped while the investigation continues.
Client organizations have started telling their own members. The Japan Society of Civil Engineers, for example, said Arara contacted it and that it is checking whether its addresses are included (in Japanese). Arara says the investigation is ongoing and it will share new findings as they come in.
What this means for you
What’s confirmed so far is email addresses. On their own they can’t get anyone into your accounts. The likely effect is more spam and phishing, and some of it may pretend to come from organizations you really do get email from.
What you can do
- Watch for notices from groups you get newsletters from in Japan. Some, like the Japan Society of Civil Engineers, are already telling members.
- Don’t click links or open attachments in unexpected emails, and don’t reply. Arara asks people who receive suspicious mail to delete it.
- Go to the organization’s site yourself if an email asks you to sign in, pay or update your details.
- Never enter a password or personal details from a link in a message you weren’t expecting.
- Learn the patterns. See how scammers use leaked data.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame’s email aliases also let you give each newsletter its own address, so you can tell which list leaked and turn that address off. Frame never collects or stores the leaked records themselves.
Sources
- Arara, 当社が提供する「アララメッセ－ジ」への不正アクセスによる情報流出およびサービス停止について (in Japanese), October 29, 2026
- Japan IR, Paycloud Holdings Inc.: Notice of Information Leak and Service Suspension, October 29, 2026
- NHK, メール配信会社「アララ」 不正アクセスで300万件のメアド流出 (in Japanese), October 29, 2026
- Japan Society of Civil Engineers, メール配信サービスからの情報流出について (in Japanese), October 29, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.