Arara Message breach: 77 million email addresses and a hijacked email service

The Arara Message breach involved both customer data theft and misuse of an email delivery service. In its November 2, 2026 notice, Arara reported roughly 77 million email addresses taken from client environments and up to 7.13 million scam emails sent through parts of its service. The attackers supplied their own recipient list for those messages.

For business owners, the distinction matters: an outside provider can lose customer information and become a tool for attacking other people.

The onslaught of digital violence in Japan continues. And it is changing shape.

What happened in the Arara Message breach?

Arara Message is an email delivery service operated by Arara, a subsidiary of Paycloud Holdings. Arara reported unauthorized access affecting up to about 380 client companies. Depending on what those companies had uploaded, the exposed data also included names, phone numbers, addresses, and other customer information.

That’s bad. It’s also a story we’re becoming uncomfortably used to hearing.

A company announces unauthorized access. A large number appears in the headline. Customers are told to be careful. The rest of us wonder whether our information was there, then get back to work.

But something else happened inside this system. The attackers put it to work.

How did attackers use Arara Message to send scam emails?

According to Arara’s November 2 incident notice, attackers used parts of the service to send up to 7.13 million messages impersonating a credit card company between October 28 and 30. The sender address was news@arara.com.

They were sending through the actual service, using its real address. The messages asked recipients to check account activity or statements.

And the recipients weren’t simply a list exported from the breached customer database. Arara says the attackers brought email addresses in from outside.

That detail matters. They came with their own target list and used someone else’s infrastructure to reach it.

It’s one thing to steal a company’s records. It’s another to occupy its systems and give them a new purpose. The address still belonged to Arara. The machinery was still Arara’s. What had changed was whose instructions it followed.

An impostor doesn’t have to copy your appearance if it can operate from inside you.

What data was exposed, and were credit card numbers stolen?

The roughly 77 million figure refers to email addresses, not necessarily 77 million people. Someone may have more than one address, and Arara said its figures were still being checked.

The company identified data taken from 97 servers in environments used by its corporate clients. The information included whatever customer fields those businesses had registered with the service: potentially names, dates of birth, phone numbers, membership numbers, and addresses, as well as email addresses. The fields varied by client.

Arara said it did not hold credit card numbers in the service. That is different from saying there was no financial risk. The separately reported scam messages impersonated a credit card company, and Arara advised anyone who had entered card information through those messages to contact their card issuer.

There are also limits to the takeover claim. The notice describes misuse of parts of the service in two sending environments. It does not establish that attackers controlled every part of Arara’s business or its entire platform.

We don’t need to exaggerate that access to see the problem. Access sufficient to send millions of fraudulent messages is enough.

Why does an email provider breach matter to your business?

For a customer, the connection to an unfamiliar provider is ordinary. You give a business your details. That business uses another company to send emails. Your information ends up in that company’s systems, even if you have never heard its name.

For a business owner, the relationship carries two different kinds of trust. If you haven’t mapped the services behind the work, start with the real Japanese SME stack: LINE, Excel, fax, and one person. The account you remember paying for may be only part of the setup.

You trust the provider to look after the information you upload. You also trust it to perform an action: send messages, issue tickets, take bookings, or handle some other part of your operation.

A breach can compromise either side of that arrangement. Here, the incident involved both data theft and misuse of the delivery service.

The unsettling part is that the system does not have to disappear or look obviously broken to serve someone else. Its useful function becomes useful to an attacker. It still sends emails. They are simply no longer being sent for the reason the service exists.

That is the bodysnatcher problem. The familiar machinery remains. Another purpose moves in.

Can you trust an email from a real sender address?

A real sender address is useful information. It is not a guarantee that the request in the message is legitimate.

In this incident, the messages claimed to concern a credit card company while coming from Arara’s address. That mismatch deserves attention. But the larger lesson is that checking an address cannot, by itself, tell you whether the underlying service is being misused.

The safer response to an unexpected payment or account warning is to leave the message and open the company’s app or website yourself. Use a saved bookmark or a known contact route, rather than the link or telephone number supplied in the warning.

Arara specifically warned about messages and calls claiming to come from it or its client companies. Its notice told recipients not to follow suspicious links, enter passwords or card information, or open unexpected attachments.

CISA’s guidance on recognizing and reporting phishing makes the same practical distinction: don’t use a suspicious message’s links or phone numbers to check whether it is real. Look up another way to contact the organization.

This isn’t a demand that everyone become a security analyst. It’s a habit: verify a consequential request somewhere other than the message making it.

What should business owners check after an email provider breach?

Start with five checks: identify the provider, review the customer data it holds, check account access, assign someone to security notices, and plan for an outage. These are practical precautions, not findings about the cause of the Arara breach.

The answer isn’t to abandon outside providers and run everything yourself. It’s to understand what you’ve handed over and who is responsible for it.

Start with the service that sends your customer emails. Record its name, the account owner, the information stored there, and the person responsible for security notices. If an agency set it up, ask which underlying provider it uses. “The agency handles it” should lead to an answer, not end the conversation.

Then look at the customer fields you’ve uploaded. Does an email delivery service need postal addresses or dates of birth for the job you use it to do? There may be a valid reason. If there isn’t, stop supplying them and review what should be removed from existing records. Information that isn’t there cannot be taken from that service.

Check who can operate the account. Give people their own permissioned access where the service supports it, use multifactor authentication, and remove access that is no longer needed. These are sensible precautions, not a claim that they would have prevented this particular incident. For the ownership and offboarding side, see shared accounts and logins in a small business: who owns what.

Finally, decide what happens when the provider stops working. Arara completed the shutdown of Arara Message on October 31, and its November 2 notice gave no restart date. A business depending on that service had an operational problem alongside the privacy problem.

Who checks whether your account is affected? Who stops a scheduled campaign? How do you contact customers if the usual channel is unavailable or under suspicion? Those answers should exist before a security notice arrives.

The takeaway: who is responsible for your email setup?

Outsourcing a service is a business decision. So is deciding how much customer information to put there, who can use it, and what happens when something goes wrong.

You don’t need to run the servers. You do need someone who knows which services your business depends on and acts when the terms of that trust change. If the foundation already works but nobody owns the day-to-day administration and vendor oversight, that’s the work covered by Ongoing Stewardship.

The Arara incident deserves attention for the scale of the reported data theft. But the number alone misses what happened to the system itself.

The attackers brought their own list. They used the service’s own machinery. For a time, infrastructure built to deliver legitimate messages was serving another agenda.

The question is no longer only what someone could take from your business.

It’s what they could make your business do.

If you’re not sure who handles your customer emails, what they hold, or who can use the account, get in touch about Diagnostics: a paid review of your email setup, tools, and ownership. We’ll identify what needs attention and what to fix first.

Sources

• Arara: information leakage and service suspension following unauthorized access to Arara Message, second notice, November 2, 2026 (Japanese).
• CISA: “Recognize and Report Phishing”.
• Jiji Press via Nippon.com: “77 M. Email Addresses Leak from Arara Message Due to Cyberattack,” November 2, 2026.

This article uses the findings reported in Arara’s November 2 notice. The company said its investigation was continuing and its figures could change.