Attackers who broke into Arara Message, a Japanese bulk email delivery platform used by hundreds of companies to reach their customers, may have walked away with about 77 million email addresses and then used the service itself to blast out millions of phishing emails. Tokyo-based Paycloud Holdings, the parent company of service operator Arara Inc., disclosed the expanded scope in a second incident report published on November 2.
The company says the intrusion ran from October 28 to October 31 and reached 97 servers belonging to client environments, affecting up to about 380 corporate customers. Paycloud stresses that the 77 million figure is preliminary. It counts email addresses rather than people, has not been deduplicated, and includes data that may have been taken but has not been confirmed as stolen.
From one shared environment to 380 clients
Arara first disclosed the incident on October 29, when it described unauthorized access to a shared environment used by multiple clients. The second report revised that piece of the breach to 3,386,187 unique email addresses across 61 companies. Five of those companies also lost up to 411,827 customer records containing more than an email address.
The bigger number comes from what investigators found next. Paycloud says the attackers also extracted data from dedicated server environments used by contracted companies, which is where the estimate of roughly 77 million addresses originates. Depending on the client, the exposed records may include:
- Email addresses
- Names and gender
- Dates of birth
- Phone numbers and postal addresses
- Membership numbers
Arara does not hold credit card numbers, and the company says no payment card data was involved. Arara has also revised its explanation of how the attackers got in, saying the intrusion involved weaknesses in its system environment in addition to a web server vulnerability. It has not published technical details or a CVE.
The platform was turned into a phishing cannon
What makes this incident more dangerous than a typical marketing database leak is that the attackers did not stop at stealing data. Between October 28 and October 30, they used Arara Message to send up to about 7.13 million suspicious emails impersonating credit card companies. The messages came from the service’s own sender address, news@arara.com, and used subject lines asking recipients to confirm card usage or review billing statements.
Because those emails went out through legitimate delivery infrastructure, they had a better chance of landing in inboxes than ordinary spam. Arara says it blocked communications from the affected environments, invalidated compromised credentials, and confirmed that no further suspicious emails were sent after October 30.
Arara then suspended the entire Arara Message service on October 31. No restart date has been set. Before the service comes back, the company plans to require client companies to reset administrative passwords, API keys, and other authentication details.
Why a single vendor breach spreads so far
Email delivery platforms sit at a sensitive point in the supply chain. Retailers, membership programs, and service providers hand them their customer lists so they can send newsletters, receipts, and account notices at scale. A compromise at the vendor exposes the customers of every one of those businesses at once, even if each client’s own systems were never touched.
The Arara breach is the latest in a run of large incidents at Japanese organizations. BreachNews recently reported on the Club Tourism breach affecting 4.32 million member records and on KDDI’s third-party software breach that may have exposed 14.2 million email accounts. On the same day as Paycloud’s second report, Suntory Holdings disclosed a breach of an external cloud service that exposed data on about 90,000 employees.
What happens next
Paycloud says it has reported the incident to Japan’s Personal Information Protection Commission and to police, and that it is working with outside specialists to determine the cause and full scope. It plans to notify affected parties and will disclose any financial impact in a third report. The company has not named any of the affected client companies.
Anyone who receives marketing or membership emails from Japanese businesses should treat unexpected messages about card statements, account verification, or delivery problems with suspicion, especially those that appear to come from Arara or a company that uses it. Go directly to the company’s official website or app instead of clicking links. Readers who want to check whether their address has turned up in known breaches can follow our guide on how to check if your email, phone or password was in a data breach.
Paycloud’s disclosures are available on its official information page.
