Arara breach: Asoview says 15.8 million member records leaked, and more companies name their counts

On November 2 we wrote that Arara, the Japanese company behind the Arara Message newsletter service, now counts about 77 million email addresses taken from servers used by up to about 380 client companies. Since then, the companies that used the service have started telling their own customers what was in their share. The biggest so far is Asoview, which runs one of Japan’s largest leisure and ticket booking sites. If you’re a member of any of the services below, here’s what each one has said.

Asoview: 15,821,184 member records

On November 3, Asoview announced (in Japanese) that member information it had handed to Arara Message for sending emails had leaked: 15,821,184 records, according to CNET Japan and ITmedia (both in Japanese). This is far more than an email list. The reports say the records include:

• email address, member ID and member number
• name, gender and date of birth
• phone number, postal code and area of residence
• when the account was registered and last signed in
• ticket history: when a ticket was bought, what kind, how many, the facility, the date of the visit, the number of people and whether it was cancelled

Asoview says it never gave Arara passwords or credit card numbers, so those weren’t part of the leak, and that its own systems weren’t the cause. It learned of the leak from Arara on November 2, stopped every mailing that went through Arara Message the same day and disabled the admin passwords and API keys it used with the service. It got the list of fields and the count on November 3.

It still doesn’t know which members are in the leaked data. Arara is working that out, and Asoview says it will check the results against its own records and contact affected members one by one. Until then it is asking all members to be wary of emails, texts and calls that use refunds, cancellations, prizes or identity checks as a reason to ask for personal details or money. It says it never asks for passwords or card numbers by email, text or phone.

Other companies that have told customers

Several more companies published notices on November 3 and 4. In each case the company says the leak happened at Arara, not in its own systems.

These counts come from different companies and may overlap with each other and with Arara’s total, so they can’t be added up. Mail from several of these services is paused while Arara Message stays shut down. TKC says it is moving its email to a different platform.

What this means for you

For most of these companies, what leaked is an email address tied to a service you use. That is enough for a convincing fake: a message that names the bank, phone company or shop you actually deal with. The Asoview data goes further. Someone holding it could write to you by name, mention your birthday and refer to a real ticket you bought for a real day out. That kind of detail makes a refund or cancellation scam much easier to believe.

The attacker also used Arara Message to send up to about 7.13 million fake credit card emails from news@arara.com between October 28 and 30, as we covered in the November 2 post. The companies above are warning that more phishing aimed at their customers may follow.

What you can do

1. Be extra careful with messages about refunds, cancellations, prizes or identity checks from Asoview or any of the companies above. Open the app or type the address yourself instead of tapping a link.
2. Never give a password, card number, PIN or verification code to someone who contacts you, even if they know your name, birthday and booking. Asoview, Shikoku Bank and the others all say they never ask for these by email or phone.
3. Watch for an individual notice. Asoview and Shikoku Bank say they will contact the people affected once Arara’s list is matched.
4. If you used the same password at a service that emailed you and somewhere else, change it. None of these companies say passwords leaked; this simply limits the damage if a phishing page catches one.
5. Learn the patterns. See how scammers use leaked data.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each newsletter and shop its own address, so you can tell which list leaked and turn that address off. Frame never collects or stores the leaked records themselves.

Related coverage

• Arara now says about 77 million email addresses were taken: Arara’s second report, which these company notices follow from.
• Arara Message: about 3.01 million email addresses taken: the first report, from October 29.

Sources

• Asoview, 委託先メール配信サービスへの不正アクセスに関するお詫びとお知らせ (in Japanese), November 3, 2026
• CNET Japan, アソビュー、会員情報1582万件が流出 チケットの購入・利用履歴も (in Japanese), November 4, 2026
• ITmedia NEWS, アソビュー、会員情報1582万件流出　最終ログイン日や利用施設も　メール委託先・アララ不正アクセスで (in Japanese), November 4, 2026
• TKC, メール配信委託先への不正アクセスによる情報漏えいに関する件（第3報） (in Japanese), November 4, 2026
• Workman, Workman Co.,Ltd. Notice on Possible Email Address Leakage (via Japan IR), November 4, 2026
• IIJ, 当社が利用するメール配信サービスへの不正アクセスによるお客様情報の漏えいについて (in Japanese), November 4, 2026
• Duskin, メール配信サービス提供事業者への不正アクセスによるお客様メールアドレス漏洩に関するお知らせとお詫び (in Japanese, PDF), November 4, 2026
• Nikkei, 琉球銀行、9万6000件のメールアドレス漏洩　委託先に不正アクセス (in Japanese), November 4, 2026
• Shikoku Bank, メール配信サービスへの不正アクセスによるお客さまメールアドレス流出について (in Japanese), November 4, 2026
• Ekitan, 【重要】メール配信サービス提供会社への不正アクセスによる情報流出に関するお詫びとお知らせ(第一信) (in Japanese), November 3, 2026
• ITmedia NEWS, メルアド7700万件流出か　アララメッセージの不正アクセスで続報　共通環境から契約企業のサーバへ侵入　悪用も確認 (in Japanese), November 4, 2026