Arara, the Japanese email delivery company owned by Tokyo-listed Paycloud Holdings, said on November 2 that the break-in at its Arara Message service may have exposed about 77 million email addresses, ASCII.jp and BigGo Finance report. When Arara and Paycloud first disclosed the breach on October 29, the figure was about 3.01 million, so the new number is roughly 25 times larger. Both reports say the 77 million includes data that may have been taken and is still being checked. Neither says whether duplicates have been removed. The attacker reached 97 servers used by client companies, and as many as about 380 companies may be affected. Arara also says the platform was used to send about 7.13 million phishing emails pretending to come from credit card companies. The whole service has been shut down since October 31 and there is no restart date.
What Happened
Arara Message lets Japanese businesses send newsletters, notices and marketing email to their customers. The people on those lists usually have no direct relationship with Arara. Their addresses sit on Arara's servers because a company they deal with uses the service.
According to a timeline compiled by Japan's Web Security Diagnosis Center (Webセキュリティ診断センター) from Arara's own notices:
- October 22: Arara announced emergency maintenance after two critical PHP vulnerabilities were published on October 21. It took several parts of the service offline and said this was a precaution. At that point it said it had found no unauthorized access.
- October 28: Arara confirmed unauthorized access to part of its systems, disconnected the affected server and suspended the affected environment. Later that day it confirmed that about 3.01 million email addresses had been taken from one environment, identified as "bvam001". It said nothing other than email addresses had been taken.
- October 29: Paycloud Holdings (TSE Growth: 4015) filed a timely disclosure giving the same 3.01 million figure. It blamed a third party exploiting a web server vulnerability and said it would recheck all services with an outside specialist firm. NHK reported that email delivery had stopped.
- October 31: Arara suspended the whole service, according to ASCII.jp.
- November 2: Arara published the revised scope. ASCII.jp attributes the announcement to Arara, and BigGo attributes it to Paycloud.
The revision also expanded the original incident. ASCII.jp and BigGo both report that the count for the shared environment disclosed on October 29 now covers 61 companies and 3,386,187 unique email addresses, up from 3.01 million.
Client companies have received changing information. The precious-metals dealer unbanked said on October 30 that Arara had told it its newsletter subscribers were not affected, and it planned to resume sending the following week. On November 2 it posted an update saying Arara had suspended the service again and that resuming depends on Arara's investigation. That sequence suggests the earlier assurances to some clients were made before the wider compromise was known.
TSN reports that this is the second breach at a Paycloud subsidiary in under two weeks. On October 23, Paycloud disclosed a separate intrusion at another subsidiary that exposed 1.42 million prepaid card records.
What Was Taken
The reported numbers have changed several times. Readers should treat them as provisional:
- Email addresses: The first report on October 28 and 29 was about 3.01 million, from one environment. Arara and Paycloud's filing gave this figure, and Frame, TSN, NQ Brief and others repeated it. The revised count for the same shared environment is 3,386,187 unique addresses. The total across all affected servers is now about 77 million, per ASCII.jp and BigGo, and Arara says it is still checking that figure. Undercode News ran a headline claiming 301 million, but the body of its own article says 3.01 million. No other report supports 301 million.
- Other personal data: Arara first said only email addresses were taken. Under the revised account, ASCII.jp and BigGo report that the stolen data also includes names, gender, dates of birth, phone numbers, membership IDs and postal addresses, depending on what each client company stored. Arara says the service does not store credit card numbers.
- Customer records from five clients: Up to 411,827 records containing details such as names and company names were taken from five companies in the shared environment.
- Payment details at one client: Pay-don (Payどん), a regional payment service in Kagoshima run by four local banks including Kagoshima Bank, said email addresses of its users and merchants may have leaked. It said payment notification details, meaning transaction time, store name and amount, may also have leaked. This comes from Pay-don's own notice, as summarized by the Web Security Diagnosis Center.
Arara has not said how many unique people are behind the 77 million figure, how much it overlaps with the 3.39 million figure, or which client companies are affected beyond those that have announced it themselves.
Why It Matters
The attacker used the platform as well as stealing from it. ASCII.jp and BigGo report that between October 28 and 30, about 7.13 million phishing emails were sent from two Arara environments to addresses the attacker brought in. The emails came from [email protected] and used subject lines such as "Request for usage confirmation" and "Request for statement confirmation", pretending to be credit card companies. Because they were sent through a real bulk mail provider, they probably passed the sender checks that filters normally rely on.
The attacker now has data that makes phishing more convincing. Names, dates of birth, phone numbers and membership IDs, matched to which company a person deals with, let an attacker write messages that look like they really come from that company. With up to 380 client brands involved, recipients will struggle to tell a genuine breach notice from a fake one.
The disclosed scope can grow sharply. Clients were told one thing on October 29 and 30, and the scope grew about 25 times by November 2. Companies that use email service providers should not treat a vendor's first scope statement as final.
Paycloud has had two breaches in quick succession. The prepaid card breach reported by TSN raises the question of whether the group's subsidiaries share infrastructure, code or security practices. Paycloud has not addressed this publicly.
The Attack Technique
Arara and Paycloud say a third party exploited a web server vulnerability. Arara has not named the software, the vulnerability or a CVE. ASCII.jp reports that Arara now also points to problems in its system environment, in addition to the web server flaw. From the initial server, the attacker reached many other servers and copied database contents. Arara has disabled the misused credentials and blocked the attacker's connections.
The timing points to the PHP flaws. Arara ran emergency maintenance on October 22 because of two critical PHP vulnerabilities published the day before, and the intrusion was confirmed six days later. The Web Security Diagnosis Center discusses this possible link. Arara has not confirmed that the PHP flaws were the way in, and it has not said whether the attacker was already inside before the maintenance. Nobody has claimed responsibility, and no threat actor has been named.
Several things suggest the attacker had credentials, not only a single exploit. They reached 97 servers, sent mail through the platform using its own sending identity, and Arara had to revoke stolen authentication information.
What Organizations Should Do
- If you use Arara Message, assume your lists are exposed until Arara confirms otherwise in writing for your specific environment. Unbanked's experience shows that early "not affected" answers can be reversed. Check which personal data fields you uploaded, because those fields decide your notification duties under Japan's personal information protection law (APPI).
- Revoke and rotate every Arara-related credential. That includes API keys, SMTP credentials and webhook secrets for both API v1 and v2, and any login sessions for staff accounts. Check sending logs for messages you did not schedule, especially between October 28 and 30.
- Warn your customers before attackers contact them. Publish the notice on your own website and tell recipients to check any breach-related email against it without clicking links in the email. Send the warning through a different email provider, because the attacker sent mail as
[email protected]. - Block and search for the phishing campaign. Card issuers and email security teams should look for
[email protected]and the reported subject lines, quarantine matching messages, and search their logs for users who clicked. - Patch PHP and audit your own web servers. Apply the October 21 PHP fixes on any server you run, then look for web shells or new administrative accounts that may have been planted before patching.
- Treat email providers as systems that hold sensitive data. Upload only the fields you actually need to send email, require providers to keep each client's data separate, and put breach-notification deadlines and scope-update requirements in the contract.
Sources: Arara: Approximately 77 Million Email Addresses Leaked ASCII.jp En... | Arara Message: about 3.01 million email addresses taken from a Japa... | 【11/1最新】アララ メッセージ不正アクセス｜約301万件流出と影響企業｜Webセキュリティ診断センター | Japan's Paycloud Holdings subsidiary Arara suffers breach of 77 mil... | Arara Hack Exposes 3.01m Email Addresses in Japan TSN | Japan’s Arara Confirms 301 Million Email Addresses Stolen in Cybera... | Arara Message breach leaks 3.01 million email addresses — NQ Brief | 【続報・漏洩の対象外を確認】メール配信委託先（アララ株式会社）への不正アクセスに伴う情報漏洩の可能性と配信停止に関するお知らせ – u...