Arara bulk mail breach reaches 81 million addresses at 380 clients

Arara bulk mail breach reaches 81 million addresses at 380 clients

6 November 2026: Arara, the Tokyo company behind the bulk email service Arara Message, says an intruder took 81,329,467 email addresses after duplicates are removed, belonging to the subscriber lists of up to about 380 client companies. The whole service has been stopped since 31 October, and Arara has not set a date to bring it back.

How the count grew in a week

Arara, a subsidiary of Paycloud Holdings, has now published three disclosure reports, on 29 October, 2 November and 6 November, and the scope grew each time. The latest total breaks down into 78,102,937 addresses taken through the service itself, 2,842,400 from a shared environment named in the first report, and 3,249,492 from a separate cloud environment found for the third report. Arara stresses that the figures count addresses, not people.

Depending on the client, the stolen records also hold names, sex, dates of birth, phone numbers, member numbers and postal addresses. The service does not store card numbers. The client count of about 380 is an estimate that Arara says it is still checking.

The sender address became the attack

The intruder did not only copy data. From 28 to 30 October, up to about 7.13 million mails posing as credit card companies went out from news@arara.com, the address the service normally sends from, with subject lines asking recipients to confirm card use. A message from an address that subscribers had received newsletters from for years is far harder to spot than ordinary phishing.

Arara has reported the incident to the police, the Personal Information Protection Commission, JIPDEC and the Kanto Bureau of Telecommunications. Its notice is signed by Yosuke Iwai, chief executive of Paycloud Holdings, and Noriaki Kadokura, chief executive of Arara.

SEGA puts a number on its share

SEGA published its own notice on 9 November. Addresses on 2,196,044 of its newsletter lists were taken, and 92,273 of them came with further delivery-linked information. SEGA says names, birth dates, addresses, phone numbers, card data and login passwords were not included, that SEGA Account addresses sit on a different system, and that it has seen no misuse so far. It lists the newsletters sent between 2 July and 28 October 2026 that are involved.

iThome reports that other clients include publishers, retailers, a restaurant chain, banks and Japanese local authorities. We have not seen those companies' own notices.

Three conditions before a restart

Arara says the service will come back only once the intrusion route is closed, outside experts have confirmed the platform is safe, and every client's login credentials have been reset. It has not said how the intruder got in.

For a company that sends newsletters through an outside platform, the incident is a reminder that the vendor's sender domain and its subscriber store are part of the company's own exposure. Arara's clients now face a choice between waiting for a restart of unknown date and moving their lists to another sender, with the authentication and reputation work that implies. Our transactional email software category lists 18 products and our email marketing software category nine.

Arara says it will publish further updates on the same notice page as facts are confirmed.

Sources

• Arara Inc.: notice on unauthorised access to Arara Message (third update summary), 6 November 2026, 6 November 2026
• SEGA: notice on the leak of newsletter delivery addresses through a contractor, 9 November 2026, 9 November 2026
• iThome: report on the Arara breach and affected Japanese companies, 10 November 2026, 10 November 2026