Phishing
Arara Message breach: 77M addresses from a mail vendor
An attacker took address books from Japan's Arara Message mail service and sent 7.13M fake card emails through it. What senders and recipients should do.
Arara Inc., a Japanese company whose Arara Message service sends notifications and newsletters for other businesses, was broken into between October 27 and 31. In its second report on November 2, Arara said about 77 million email addresses were taken, or may have been, from the servers of up to about 380 client companies. That count is still being checked and counts addresses, not people. Depending on the client, names, gender, dates of birth, phone numbers, member numbers and street addresses went with them. Arara holds no credit card numbers. It stopped the whole service on October 31 and has not said when it will restart.
The attacker also used the service itself to send up to about 7.13 million emails posing as credit card companies, from Arara's own address. Clients are now publishing their own counts: Sumitomo Mitsui Banking Corporation (SMBC) says 227,216 addresses it mailed through Arara leaked, mainly corporate customers, with no account numbers, balances or PINs. TKC, which sends confirmations for local government My Number Card booking systems, says up to 2,230,812 addresses of its system users were involved. If your organisation sends mail through Arara, or any bulk mail vendor, this is your list too.
The figures keep moving
Arara's first report on October 29 spoke of about 3.01 million addresses from one shared environment. The second report raised that environment's figure to 3,386,187 unique addresses across 61 client companies, plus up to 411,827 customer records with names and company names registered by five of them, and added the 97 dedicated client servers with about 77 million addresses. Arara does not add the two figures together because the same address can appear in both, and it says every number may change in a third report. Treat client counts the same way: TKC wrote "up to", and it is still working out which customers and systems were hit.
How it works
A bulk mail vendor keeps an address book for each client: the recipient list and whatever fields the client uploaded to personalise messages. It also holds the client's API keys and admin console logins, and it sends from infrastructure that mailbox providers have learned to trust. One vendor compromise therefore exposes many organisations' customer lists at once, together with a way to mail those customers.
Arara describes two intrusions by what it believes is the same attacker, based on a shared attack source. In the shared environment, after access that looked like reconnaissance on October 27, the attacker logged in to the admin console on October 28 and took the data out; Arara shut that environment down at 16:31 the same day. From October 28 to 31 the attacker went through one of the service's servers to reach many others and copied their databases, which is how 97 client servers were emptied. Arara first blamed a web server vulnerability and now says problems in its system environment were also involved. It has not named the flaw or how the attacker first got in. It reported the incident to the Personal Information Protection Commission and to the police on October 29.
The fake card emails came from a news sender on the arara.com domain, with subjects such as 「利用内容確認のご依頼」 (request to confirm usage details) and 「ご利用明細確認のご依頼」 (request to confirm statement details). Arara says they went to addresses the attacker brought in from outside, not to its clients' lists. Neither Arara nor the coverage says how receiving servers scored them, but mail that leaves a real sending platform under that platform's own domain would usually pass SPF (Sender Policy Framework, the list of servers allowed to send for a domain) and DKIM (DomainKeys Identified Mail, a signature from the sending domain), the checks that catch crude spoofing.
What the stolen lists are good for
A list that says "this address gets mail from this bank" or "this person booked a My Number Card pickup with this city" is far more useful to a phisher than a random address dump. The attacker can write a message that matches a relationship the recipient really has, in the format they already receive, and add a name or member number to make it convincing. SMBC, TKC and Arara all warn customers to expect emails, and Arara adds SMS, phone calls and post, pretending to be them or their clients.
SMBC's list is mostly corporate customers. A business address paired with the name of its bank is a ready target for fake banking login pages and payment change requests.
What to do if you send through a mail vendor
- Find out whether you are affected. Arara says it will contact every client individually with whether its environment was involved and which fields left. If you use Arara indirectly, through a system vendor as many municipalities do through TKC, ask that vendor. Keep a list of which vendors hold which customer lists and fields, so the next notice takes minutes to assess.
- Cut and rotate vendor access. Arara will ask clients to reset admin console passwords and API keys before it restarts; rotate them anyway, and replace any credential your own systems store for the vendor. If you have moved to another sender for now, remove the old vendor's
include:from your SPF record and delete the DKIM selector record you published for it, so it can no longer send mail that passes as your domain. - Check sender authentication on your own domain. DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do with mail that fails those checks. With DMARC at
p=quarantineorp=rejectand aggregate reports (rua=) going somewhere a person reads, mail that claims your From domain but fails aligned SPF or DKIM is filtered, and the reports show who tried. Look for sources you do not recognise in the reports from October 27 onward. - Warn customers in plain words. Tell them which channel you use, that you never ask for passwords or card details by email, and how to reach you through your website. SMBC's and TKC's notices both say this.
- Search your own inbound mail. In Microsoft 365,
Get-MessageTraceV2 -SenderAddress "news@<arara domain>" -StartDate 10/28/2026 -EndDate 10/31/2026in Exchange Online PowerShell shows who received the fake card messages; find anyone who clicked and reset their credentials.
Then reduce what you upload. Depending on the client, the stolen records held dates of birth, phone numbers and home addresses, fields a newsletter rarely needs. Send the vendor only the fields a message uses, and delete lists you no longer mail.
What to do if you received mail
Delete any message from a news sender on the arara.com domain sent between October 28 and 30 with the subjects above, without opening the link. If you entered card details on the page it led to, call your card issuer, as Arara advises. Treat any contact that mentions your bank, city office or a shop you use and asks you to confirm details, log in or pay as suspect, and reach that organisation through its own website or app instead of the link.
If you want help reviewing which vendors hold your customer data and whether your domain's SPF, DKIM and DMARC setup would stop a spoofed campaign, our attack surface management and security operations teams do that work. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Arara second report (November 2, 2026, PDF), SMBC notice (November 5, 2026, PDF), ID Tech Wire, INTERNET Watch, Impress Watch, nippon.com, SmartScope on the 77 million figure, SmartScope on the first 3.01 million report, SmartScope on TKC, eSecurity Planet.