Paycloud Holdings (TSE: 4015) has disclosed that someone broke into part of the server system behind Arara Message, the bulk email service run by its subsidiary Arara Inc. Around 3.01 million email addresses were exposed, and the company has suspended service on the affected environment. The exchange filing, dated 29 October, blames a third party exploiting a web server vulnerability. This is the second breach at a Paycloud subsidiary in under a week. On 23 October the group disclosed a separate break-in at its Value Card prepaid service that exposed 1,424,748 card records. The filing does not name an attacker, and no group has claimed the attack.
What Happened
Arara found the unauthorized access on Wednesday 28 October. TSN reports that the company disconnected the affected server from the network straight away. Arara published two notices that day. The first said it had found unauthorized access and suspended the affected environment, but had not confirmed a leak. It also said emails already scheduled before the suspension would still go out. The second notice, posted later the same day, said a leak had been confirmed.
Paycloud's filing on 29 October covers the incident at group level. It says no other services have been affected so far. The company says it will re-check every service for vulnerabilities, work with outside specialists, and share information with the authorities and its client companies. It has not yet worked out the financial impact. According to TSN, there is no date for restarting the affected environment.
The Paycloud filing is cautious about the scope. It describes the figure as "facts currently identified" and says personal information "may have been leaked". Arara's own customer notices, as TSN reports them, are firmer: they say the addresses were taken.
This is not the Gundam Base contractor. On 27 October Bandai Namco Entertainment and BANDAI SPIRITS disclosed a leak of THE GUNDAM BASE MEMBERS registrant data through a breached email delivery contractor. Japanese outlet Denfaminico Gamer reports that the contractor was Yumir Link, not Arara, and that Yumir Link reported the intrusion to Bandai on 26 October. That was two days before Arara found its own breach. Neither company has published anything linking the two incidents.
What Was Taken
- Volume: about 3,010,000 email addresses. Paycloud's filing and TSN's report of Arara's notices give the same figure.
- Data type: TSN reports that Arara describes the data as "email addresses registered in end-user lists". These are the recipient lists that client companies upload to send marketing and notification mail. Arara says it has found no sign that anything beyond email addresses was taken.
- Whose data: the people on the lists are customers of Arara's clients, not of Arara. Paycloud's filing says both end users and client companies are affected. Arara has not said which clients' lists were on the breached environment, or how many clients there were.
Email addresses on their own are not very sensitive. Here, though, each address is tied to a known brand relationship: the attacker knows which company each person receives mail from. That makes convincing phishing much easier.
Why It Matters
Three Japanese mail services in three weeks. Arara is the third Japanese company that sends email on behalf of other organisations to report a breach this month:
- Arcadia (SpeeCAN RAIDEN), 11 October: Arcadia runs a disaster alert service used by local councils and police forces. Safeguard's analysis of Arcadia's own reports says up to 3,136,000 addresses may have leaked. An implant left on the system then sent 1,423,428 phishing emails.
- Yumir Link, 26 October: Yumir Link's breach reached Bandai Namco's Gundam Base member list.
- Arara, 28 October: the incident covered in this brief.
There is no public evidence that the same attacker is behind all three. Still, companies whose job is to hold and mail other businesses' customer lists are clearly being targeted.
A pattern inside the Paycloud group. The Value Card filing of 23 October also blames "third-party exploitation of a web server vulnerability". On 22 October, Paycloud's newsroom carried a notice that some subsidiary services were temporarily suspended to deal with a critical PHP vulnerability. Paycloud has not said whether that PHP issue is the flaw behind either breach, or whether the two breaches are connected. Defenders should not assume a link, but should watch for one in later disclosures.
The risk to recipients. The Arcadia case shows how stolen recipient lists from a trusted sender can turn into mass phishing. A similar thing happened in September: according to QUE.com's write-up of the Brevo incident, attackers exported contact lists from 43 Brevo customer accounts and sent phishing from six of them. Arara says it stopped service on the breached environment. The bigger risk now is lookalike campaigns that impersonate Arara's client brands.
The Attack Technique
Paycloud says only that a third party exploited a web server vulnerability in part of Arara's environment. It has not named the software, the flaw, or a CVE. Nothing has been published about how long the attacker had access, whether they moved beyond the one server environment, or whether they sent any mail through the platform.
Those questions matter because of what happened at Arcadia. There, the path traversal flaw used to get in was only the start. Arcadia's own reports show the attacker then installed a WordPress plugin and a backdoor that kept working after the original hole was closed. Until Arara publishes forensic findings, it is not clear whether this intrusion was a single data grab or something more lasting.
What Organizations Should Do
- Arara Message customers: ask Arara directly whether your recipient lists were stored on the affected environment. Then decide whether you need to notify your own customers or report to Japan's Personal Information Protection Commission.
- Brands whose lists may be exposed: warn your customers in advance that you will never ask for credentials or payment by email. Watch for lookalike domains and phishing campaigns that use your brand.
- Mail authentication: make sure your sending domains publish strict SPF, DKIM and DMARC records (
p=rejectwhere you can), so that spoofed mail claiming to be your brand gets rejected. - Vendor review: list every outside email or notification service that holds your customer data. Ask each one what version of PHP and its web stack it runs, how fast it patches, and when it was last tested. Ask Paycloud subsidiaries in particular how they handled the critical PHP vulnerability from 22 October.
- Secrets and accounts: rotate API keys and integration credentials shared with any email delivery provider that has had an incident, and turn on two-step login for provider accounts. In the Arcadia breach, a stolen shared secret was what let the attacker go from reading a file to logging in.
- Remove old data: delete stale recipient lists from outside platforms on a set schedule. A list that isn't sitting on a vendor's server can't be stolen from it.
Sources: Paycloud Holdings Inc. - Notice of Information Leak and Service Sus... | Beyond the mailbox: Graph reconnaissance and ServiceNow user enumer... | Arara Hack Exposes 3.01m Email Addresses in Japan TSN | ニュース｜ペイクラウドホールディングス | AA26-281A: Hunting Exchange and M365 Mail Theft | SpeeCAN RAIDEN Breach: A Disaster Alert SaaS Sent 1.42M Phishing Em... | How Supply Chain Malware Is Weaponizing Trusted SaaS Platforms - QU... | Paycloud Holdings Inc. Notice of Unauthorized Access to Value Card｜...