Arara Message hit by major data breach, exposing 77 million email addresses

Arara, a Japanese email service provider, has reported a significant security breach that exposed nearly 77 million email addresses across approximately 400 client organisations.

Headquartered in Tokyo, Arara, a subsidiary of Paycloud Holdings, is a Japanese IT and email-delivery provider specialising in bulk messaging, data security, and augmented reality. The company is known for Arara Message, a high-volume corporate email delivery system for customer notifications and newsletters, and P-Pointer, a security suite that scans corporate networks, detects unprotected personal information, and prevents internal data leaks.

In a security incident notice published on its website, Arara said that it recently detected unauthorised access to certain servers supporting its email distribution service. The company promptly initiated an investigation with the help of external cybersecurity experts to assess the nature and extent of the breach.

It also took steps to secure the affected systems and disconnected the affected server from the network to prevent further spread of the incident and notified relevant law enforcement authorities the same.

Arara’s initial investigation indicated that the incident had exposed personal information, including approximately 3.01 million email addresses belonging to clients using the affected environment.However, in a subsequent update, the company disclosed that attackers had exfiltrated as many as 77 million email addresses across 380 client organisations.

The compromised information included individuals’ names and email addresses. Arara also announced that it had suspended the service on October 31, 2026, with no decision yet on when operations will resume.

Several organisations have begun disclosing their exposure to the Arara Messaging incident. SMBC Consumer Finance reported that 227,216 email addresses used for its email distribution service were compromised following an unauthorised intrusion involving its third-party email service provider.

Japanese cryptocurrency exchange Zaif also confirmed that the Arara security incident exposed 380,536 customer email addresses. However, the company assured that its own systems remained secure and that no other sensitive information, including names, addresses, trading records or passwords, was compromised.

Please take 30 seconds to register

Already have an account? Sign in

10-month cyber attack exposes personal data of South Korean diplomats

$12M Vanishes in Crypto Heist Targeting Cork Protocol’s Depeg Market

149 Million Login Credentials Exposed in Massive Unsecured Database

15-year-old hacker arrested over massive French government data leak

$600 million stolen & returned in biggest ever crypto heist

10-month cyber attack exposes personal data of South Korean diplomats

$12M Vanishes in Crypto Heist Targeting Cork Protocol’s Depeg Market

149 Million Login Credentials Exposed in Massive Unsecured Database

15-year-old hacker arrested over massive French government data leak

183 million business contacts stolen from DemandScience listed for sale by hacker

18 oil and gas companies pledge to cooperate against cyber attacks

2,650% surge in email attacks against ICO in 2021, data reveals

$600 million stolen & returned in biggest ever crypto heist

Securing the Hybrid Cloud Security in the AI era

Closing the AI control gap - architecting security across users, applications, and agents

Bridging the gap between NCSC CAF compliance and continuous device availability

Winston House, 3rd Floor, Units 306-309, 2-4 Dollis park, London, N3 1HF