Arara Message Breach Update: About 81 Million Email Addresses

Published8 November 2026
6 min read

Contents8

PayCloud Holdings, the parent company of Arara Inc., published its third report on 6 November 2026 on the unauthorised access to the email delivery service "Arara Message". The number of email addresses taken now stands at 81,329,467 after removing duplicates (about 81 million) (including those possibly taken).

This article is a follow-up to what we reported in "Cyber Incidents in Japan, October to November 2026". It sets out what has changed since the second report, the impact disclosed by client companies, and what to check next. The content is as of 8 November 2026.

Key takeaways

It has newly come to light that 3,249,492 records were taken from a separate cloud environment (Environment B).
The shared environment figure in the second report has been corrected from 3,386,187 to 2,842,400.
Client companies concerned: up to about 380 (estimated, under review). The service remains stopped, and no date has been set for restarting it.
The figures are numbers of email addresses, not numbers of people. Identifying the route of intrusion and finalising the figures are expected to take more time.

~81 million

Email addresses taken (duplicates removed, including those possibly taken)

~380 companies

Client companies concerned (maximum, estimated)

~7.13 million

Suspicious emails sent (maximum)

What has changed since the second report

Item	Second report (2 November)	Third report (6 November)
Unauthorised access via the main service (Environment A)	About 77 million (under review)	78,102,937
Shared environment	3,386,187	2,842,400 (corrected)
Environment B (a separate cloud)	―	3,249,492 (newly found)
Total after removing duplicates across categories	Not totalled	81,329,467
Of which, email address only / with attribute information	―	34,285,087 / 47,044,380 (breakdown under review)

※ All figures are numbers of email addresses. They include those possibly taken. "Attribute information" includes, depending on the client company, name, gender, date of birth, phone number, membership number, address and so on.

※ According to the third report, the unauthorised access to Environment B was part of the same series from 28 to 31 October as in the second report, and the report says it was not new unauthorised access. Credentials were misused, and only email addresses were taken.

Also, "from 27 to 28 October" in the second report has been revised: the unauthorised login and taking of data occurred on 28 October, and 27 October was access believed to be reconnaissance.

Timeline so far

27 October 2026
Access believed to be reconnaissance
28 October 2026
Unauthorised access confirmed. From this day through the 30th, up to about 7.13 million emails posing as credit card companies were sent
29 October 2026
First report published (about 3.01 million email addresses). Reported to the police
31 October 2026
All services stopped
2 November 2026
Second report published (about 77 million, up to about 380 companies)
6 November 2026
Third report published (81,329,467). Policy for preventing recurrence published at the same time

Disclosures by client companies (those we could confirm)

Disclosures are also continuing from companies that use Arara Message. The following are examples we could confirm in each company's official announcements. This is not a list of all client companies.

Company	Disclosed	Records	Details
TKC	2 November	Up to 2,230,812	Email addresses of system users
Chobirich	4 November	1,348,525	Members' email addresses (not the number of members)
St. Cousair	3 November	878,343	Members' email addresses
Life Corporation	6 November	133,330 (potential)	Online supermarket email addresses, postal codes and member registration dates. Arara was used as Fujitsu's subcontractor

※ Each company's figures are as of its own announcement. They cannot be simply compared with Arara's overall figure.

In Life Corporation's case, information was entrusted through a subcontracting chain: Life Corporation → Fujitsu → Arara. Life Corporation says it was contacted by Fujitsu on 3 November, and on 4 November found that its information might be included.

What is still unknown

Route of intrusion: The second report gives the cause as "a web server vulnerability and problems in the system environment", but even in the third report, identification is still in progress.
Final figures: The review is continuing, and the figures may change.
When the service will restart: The stated plan is to decide after completing countermeasures for the route of intrusion, having an outside specialist organisation confirm safety, and having client companies' credentials reset.
Impact on business results: The parent company says this is under review.

What client companies should check

Check for contact from Arara
Arara says it will contact client companies that use Environment B individually. Check which department in your company receives it.
Look into subcontracting relationships
Even if your company has no direct contract, one of your contractors may be using the service. Check with the company you have entrusted with email delivery.
Check whether attribute information was included
What you tell customers and what you report will differ depending on whether you registered only email addresses or also names and phone numbers.
Prepare what to tell customers
A leak of personal data may require a report to the Personal Information Protection Commission and notification of the individuals concerned. For a specific judgement, check with a lawyer or the Commission's guidance.
Prepare to reset credentials
A reset is said to be required when the service restarts. If you use the same password elsewhere, change it there first.

Watch out for suspicious emails

Emails received from news@arara.com on 28–30 October with subjects such as 「利用内容確認のご依頼」 (request to confirm usage) and 「ご利用明細確認のご依頼」 (request to confirm your statement) should be deleted without opening the URLs in them. If you entered your card details, contact your card company immediately. Arara and its parent company say they will not ask you to enter passwords or card details by email.

Status of the three cases covered in the earlier article

As of 8 November 2026, we could not confirm any new disclosures on the following cases (what we were able to check was each organisation's list of notices).

Organisation	Latest disclosure we could confirm
Nojima	Notice of 2 November
IDC Frontier	Seventh report of 27 October
Osaka Metropolitan University	Fifth report of 21 October

For new cases, see "Japan Data Breaches: Early November 2026".

How Digi Dinos can help

Digi Dinos is a company that supports DX, security, and the operation and maintenance of systems. We are ISO 27001 certified, and our team works in Japanese.

Inventory of outside services: we sort out which services hold what information.
System inspection and updates: we look into old software and what is publicly exposed, and put together an update plan.
Taking over systems whose contractors are unclear: even with no documentation, we read and investigate the code.

Are your contractors safe? Even a simple question is welcome (free consultation).

We guide you in Japanese, starting from sorting out your outside services.

System takeover service Contact us

Frequently asked questions

If only email addresses are involved, is there nothing to worry about?

Even without names or addresses, they may be used for spam or phishing that uses a company's name. Don't open links in emails you don't recognise.

Is there a way to check whether my information is included?

Arara has not published a list for individuals. Check the official notices of the services you receive emails from.

Could the figures change again?

The parent company says it expects that finalising the number of leaked records and identifying the cause will still take time. Check future announcements.

Sources (checked on 8 November 2026)