Arara confirms breach of about 77 million email addresses in Japan
Arara, a Japanese email delivery provider, says attackers exploited a web-server vulnerability in its Arara Message service and reached environments of up to 380 client companies on 97 servers, beyond the shared environment disclosed Oct. 29. About 77 million email addresses were taken or possibly taken, a count still being refined that does not measure unique people; the service has been suspended since Oct. 31 with no restart date. Attackers also sent up to 7.13 million phishing emails posing as credit-card companies, and more phishing aimed at affected addresses is expected.
What happened
Arara, a Japanese email delivery provider, confirmed that attackers exploited a web-server vulnerability and accessed its Arara Message service and client-company environments. Its Nov. 2 second report raises the estimate to about 77 million email addresses taken or possibly taken, across up to 380 client companies. The service has been suspended since Oct. 31, with no restart date.
Why it matters
Stolen data can include names, gender, birth dates, phone numbers, member IDs and addresses, depending on the client; Arara says it holds no card numbers. Attackers abused the service itself to send up to 7.13 million phishing emails posing as credit-card companies, and more phishing aimed at affected addresses is expected. Companies using Arara for email delivery are directly affected.
What to do
Suspend campaigns through Arara Message, confirm with Arara whether your environment was affected, and warn customers about phishing risk. Watch for messages impersonating credit-card companies and reinforce guidance to affected users.
For the technical team
- Affected
- Arara Message, serviço de entrega de e-mails da Arara (Japão); um sistema de servidor invadido · Arara Message email-delivery service, by Arara (Japan); environments of up to 380 client companies on 97 servers.
- Exploitation
- The victim confirmed the intrusion and data theft; no actor, CVE or ransomware group named. Attackers also sent up to about 7.13 million phishing emails posing as credit-card companies through the service itself.
- Fix
- No software fix applicable; the entire Arara Message service has been suspended since Oct. 31, with no restart date, while Arara re-checks all its services.
- Vector
- Exploitation of a web-server vulnerability in the Arara Message service, blamed by Arara on a third party; no CVE or specific flaw named. Unauthorized access was detected Oct. 28, 2026, and the affected server was cut off from the network. Beyond the shared environment, attackers reached client-company environments on 97 servers.
- More details
- Arara revised the shared-environment count to about 3.39 million unique addresses and says not to sum categories because of overlap. Client SMT Members corrected its earlier no-impact notice: members' email addresses leaked. Hyogo Prefecture's Hyogo Bosai Net suspended email alerts and says its addresses were not stolen. DailyDarkWeb notes no confirmed link to the separate ValueDesign/Paycloud prepaid-card incident. The about 77 million figure counts addresses, not unique people.
Timeline
Arara's second report expands the case from 3.01 million to about 77 million email addresses, with access to environments of up to 380 client companies on 97 servers.
Victim confirms intrusion detected Oct 28, with 3.01 million email addresses stolen.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
- @DailyDarkWeb @DailyDarkWeb
