On 2 November 2026, Paycloud Holdings published a second report on the break-in at Arara Message, the business email delivery service run by its subsidiary Arara. The figures are much larger than first announced. Between 28 and 31 October, the intruder used the service's servers as a stepping stone into many other servers and copied database contents. Data was taken from 97 servers dedicated to client companies, and about 77 million email addresses were taken or may have been taken. Up to about 380 client companies may be affected (a preliminary estimate). The 77 million figure is still being checked, is not de-duplicated and may change.
The first disclosure (Arara on 28 October, Paycloud on 29 October) mentioned only about 3.01 million addresses from one shared environment. On 30 October Arara said it had found no leak in other environments. The shared-environment figure now stands at 3,386,187 unique addresses across 61 companies. For five of those companies, customer data including names and company names was also taken (up to 411,827 records). Depending on what each client stored, records on the dedicated servers can include name, gender, date of birth, phone number, member number, address and delivery history. Arara says it holds no credit card numbers.
The service was also used for phishing. From 28 to 30 October, two of its environments sent up to about 7.13 million fake emails posing as credit card companies, to addresses the attacker brought in from outside. The sender was [email protected], with subjects such as 「利用内容確認のご依頼」 and 「ご利用明細確認のご依頼」.
Cause: Arara first said the intruder got in through a web server vulnerability. The second report says problems in the system environment also played a part. The entry route is still being investigated with outside specialists, and no technical details have been published. All Arara Message and ASP repica services have been suspended since 31 October at 14:50, including the admin panel and API. No date has been set to restart them.
This is the latest in a string of attacks on Japanese email delivery services. INTERNET Watch notes that Ymirlink's Cuenote FC reported up to 51,628,280 addresses leaked (counted with duplicates) across 50 systems, and Rakus Light Cloud's Blastmail reported that personal data for all 345 of its contracts was leaked.
