Asoview, the company that runs the Japanese leisure and ticket booking site Asoview!, announced on 3 November that 15,821,184 member records were taken when attackers broke into Arara Message. Arara Message is the email delivery service Asoview used to send mail to its customers. Every account of the incident gives the same figure: CNET Japan, TRAICY, Osegi and the Japanese breach tracker Leak Watch all cite Asoview's announcement directly. The data includes contact details and ticket purchase and usage history. Asoview says passwords and credit card numbers were never shared with Arara, so they were not exposed. Asoview is one named victim of the wider Arara breach. Japanese breach tracking reports put that breach at about 77 million email addresses, spread across up to roughly 380 client companies.
What Happened
Arara is a subsidiary of PayCloud Holdings. It first disclosed the intrusion on 29 October. Its notice said unauthorized access had been confirmed on 28 October and that about 3.01 million email addresses had been taken from one system. That count has since grown a lot. Arara's second report, dated 2 November, is summarised by the Japanese security blog Sekayasa (ai.itokoba.com) and by The Tokyo Nomad. It describes two separate parts of the breach:
- Shared environment: Between 27 and 28 October, attackers logged in to an admin console without authorization and abused its data export features. They took 3,386,187 email addresses (after duplicates were removed) belonging to 61 client companies. They also took up to 411,827 customer records, including names and company names, belonging to five of those clients.
- Client environments: Between 28 and 31 October, attackers used the service's servers to move into many more servers. They pulled database contents from 97 servers that hold dedicated client environments. Arara puts the total at about 77 million email addresses. That number includes records it believes may have been taken, judged from how much data was read, and the count is still being checked.
Arara reportedly also found its own platform being used to send phishing. Between 28 and 30 October, up to about 7.13 million emails pretending to come from credit card companies went out through two of its environments, addressed to lists the attackers brought with them. Arara took the entire service offline by 19:53 on 31 October and has not said when it will come back.
Asoview says Arara notified it on 2 November. That same day, Asoview stopped all email sent through Arara Message and cancelled its admin console passwords and API keys. On 3 November, Arara told Asoview how many records had been taken and what kinds of data were involved, and Asoview went public. TRAICY reports that Asoview plans to file initial reports with Japan's Personal Information Protection Commission and with JIPDEC, the body that runs Japan's PrivacyMark scheme. Asoview's own systems are described slightly differently in different reports. CNET Japan quotes the company as saying the leak did not come from unauthorized access to its own systems. Osegi says the company is still checking whether its own systems were accessed.
Partners have started notifying their own customers. Tokyo Metropolitan Zoos and Aquariums, which sells tickets through Asoview, posted a notice on Ueno Zoo's website. It sends inquiries to Asoview's hotline and warns visitors that the zoos will never ask for personal or payment information.
What Was Taken
Asoview says 15,821,184 records were taken. They belong to members who received emails sent through Arara Message. Asoview has said it cannot yet tell which members the leaked email addresses belong to. Arara is working out who is affected, and Asoview will match that against its own records before contacting members one by one.
The data categories are reported as follows:
- Account data: email address, member ID and member number, name, gender, registration date, last login date
- Contact and location data: postal code and area of residence
- Ticket history: purchase date and time, ticket type, number of tickets, facility used, date and time of use, number of participants, whether the booking was cancelled
Reports disagree on two of the more sensitive fields. TRAICY, CNET Japan and Leak Watch all list date of birth and telephone number as exposed. Osegi's English summary leaves both out. Three of the four detailed accounts include them, so members should assume both were taken until Asoview's member notifications say otherwise.
Every account agrees that passwords and credit card information were not stored with Arara and were not exposed. Asoview says no misuse of the leaked data has been confirmed so far.
It is not clear how many people are affected. Osegi cites an Asoview release dated 22 October that puts total membership above 23 million. The leaked records could cover a large share of that base, but Asoview has not said whether the 15.8 million figure counts records or people.
Why It Matters
This leak is more useful to fraudsters than a plain list of email addresses. It ties a real name, birth date and phone number to specific bookings: which aquarium, which day, how many people, and whether the booking was cancelled. That is enough to write a convincing message about a "refund for your cancelled booking" or a "problem with your ticket", and Asoview itself warns that criminals may use refund, cancellation, prize or identity-check pretexts. The same attackers have already shown they can send card-company phishing at scale.
The wider story is about supply chain risk. The Tokyo Nomad counts four Japanese email and messaging delivery services breached between 16 October and 2 November: Arara Message, Cuenote FC (51.6 million records), Blastmail (345 contracts) and COMSBI Enterprise. It notes that no reporting links the four breaches to a single attacker. Companies give these platforms their customer lists, and many companies keep more data with them than sending emails requires. Asoview gave Arara ticket purchase histories. When the platform falls, the client's customers are exposed, and the platform can be used to send phishing from a sender those customers already trust. Asoview says it will review how it chooses contractors, limit what it shares with them to what is necessary, and tighten oversight.
Other Arara clients are still working out their exposure. Sekayasa reports that Seijo Ishii's online store may have had up to 168,630 email addresses affected. It also reports that Osaka City and Yokohama City are still checking whether their data was involved.
The Attack Technique
Arara has given only part of the picture. Its 29 October notice blamed a vulnerability in a web server in one of its environments. According to Sekayasa's summary, the second report adds that problems with how the system was set up also played a part in the shared environment breach, where the attackers logged in to the admin console and abused its export functions. In the client environments, the attackers spread from the service's servers to 97 client environment servers and copied their database contents.
Arara says it is still investigating when the intrusion started and how the attackers first got in. It has not said which environment held Asoview's data, so it is not known which route led to the Asoview records. Leak Watch puts the Asoview leak down to the web server vulnerability, but Asoview and Arara have not confirmed that link. No group has claimed the attack, and no indicators of compromise have been published.
Sekayasa also cites a report by Cybersecurity.com (サイバーセキュリティ.com) with the following timeline. Arara spotted suspicious outbound mail at 13:08 on 30 October and cut off that environment's network access at 13:26. The last new phishing email was seen at 13:32 that day. Arara reported the incident to the Personal Information Protection Commission and JIPDEC on 29 October and also contacted the police.
What Organizations Should Do
- Find out who sends mail for you. List every email, SMS and LINE delivery provider used across your business units, including providers you no longer use. Check that list against Arara Message, Cuenote FC, Blastmail and COMSBI Enterprise, and ask each one in writing what data of yours it holds and whether that data was affected.
- Change every credential you gave the provider. Asoview's same-day response sets the standard. Cancel admin console passwords and API keys. Remove any IP allowlists or sending permissions that are no longer needed, and remove retired vendors from your SPF and DKIM records so they cannot send mail as your domain.
- Share only what is needed to send. A delivery platform needs an address and maybe a name. It does not need birth dates, phone numbers or purchase histories. Send personalisation fields at send time, or use pseudonymous tokens, so a breach at the provider exposes as little as possible.
- Look for phishing in your own mail. Search mail logs for messages that passed authentication but came through a compromised provider's sending infrastructure between 27 and 31 October, especially card-company and refund lures. Check proxy and DNS logs for clicks.
- Warn customers before the fraudsters reach them. If your customer data passed through an affected provider, tell customers now what you will never ask for (passwords, card details, payment for refunds), and give them one official place to check for updates. Asoview and Tokyo Metropolitan Zoos and Aquariums have both done this.
- Make supplier security reviews ongoing. Require breach notification within fixed deadlines, logging of admin console access, MFA on client consoles, and the right to audit how the provider separates one client's environment from another's. A breach that started in a shared environment and spread to 97 client environment servers shows why that separation matters.
Sources: Asoview data leak: 15.8M member records exposed · Osegi | Asoview Announces Data Breach Affecting 15.82 Million Members - TRA... | アララメッセージへの不正アクセスと情報流出の事案（メールアドレスと会員情報の持ち出しが確認されています。約7,700万件には持ち出しの... | Japan's mail-delivery platforms, breached in a row: 77 million addr... | Important Notice regarding Asoview! | 当社が提供する「アララメッセ－ジ」への不正アクセスによる情報流出およびサービス停止について｜ニュース｜アララ株式会社 | アソビューの情報漏洩・不正アクセス事案(2026年11月3日公表) 漏洩ウォッチ | アソビュー、会員情報1582万件が流出 チケットの購入・利用履歴も - CNET Japan