Threat watch / Breach
Arara Message: an email delivery service leaks 81 million addresses from up to 380 client companies
Japanese company Arara says an attacker broke into its Arara Message email delivery service at the end of October 2026, took 81,329,467 unique email addresses belonging to the customers of up to about 380 client companies, and used the service to send up to about 7.13 million phishing emails posing as credit card companies. Client brands are now notifying their own customers one by one, among them MOS Burger (7.5 million addresses) and SEGA (2.2 million). The service has been suspended since October 31.
- Sector
- Tech & SaaS
- Way in
- Software flaw
- Product or vendor
- Arara Message
- unique email addresses leaked, from the customers of up to about 380 companies[1]
- 81.3M
- How it happened
- Arara first said a third party exploited a vulnerability in a web server. Its second report adds that "problems in the system environment" were also involved: from the service's servers, the attacker broke into many other servers, including those of client environments, and took database contents. In its third report Arara says a separate cloud environment was also accessed with credentials between October 28 and 31. It says the start date and route of the intrusion are still under investigation.[1][2] Checked 9 Nov 2026
- What was stolen
- Email addresses, plus member information that varies by client company: name, gender, date of birth, phone number, member number and address. Arara says it does not hold credit card numbers. SEGA says its leaked data is newsletter email addresses and delivery information, without names, birth dates, addresses, card details or passwords.[1][2][4] Checked 9 Nov 2026
- Who was impacted
- Customers of up to about 380 companies that send their emails through Arara Message. Client notices so far include MOS Burger (7,517,087 addresses of web members), SEGA with SEGA FAVE (2,196,044 addresses from 11 newsletters) and, according to ITmedia, the Bic Camera group (up to about 14.9 million addresses). The City of Osaka says more than 1 million email addresses tied to its online administrative services platform, maintained by contractor TKC Corporation, were exposed, according to The Record. Recipients of the phishing emails sent from the service were also targeted.[1][4][5][8][9] Checked 14 Nov 2026
- Threat actor
- Not attributed
Timeline
- The attacker logs in and starts taking data, and phishing emails posing as credit card companies start going out from the service, from news@arara.com. Up to about 7.13 million are sent until October 30. [1][2]
- Arara reports to the police and sends a preliminary report to Japan's Personal Information Protection Commission. Asked by SEGA the same day, it says no leak has been confirmed. [2][4]
- Arara suspends the Arara Message service. [2][3]
- Second report: about 77 million email addresses taken through the service, from up to about 380 companies, on top of a shared environment used by 61 companies. [2][7][8]
- MOS Burger tells its web members that 7,517,087 email addresses and other data leaked through Arara. [5]
- Third report: the total reaches 81,329,467 unique email addresses, including 3,249,492 from a separate cloud environment accessed with credentials. [1]
- SEGA discloses that 2,196,044 newsletter email addresses leaked through Arara and suspends its mailings through the service. Arara says the restart date is still undetermined. [3][4][6]
- The City of Osaka warns that more than 1 million email addresses leaked through Arara Message, via TKC Corporation, the contractor that maintains its online administrative services platform: anyone who received an email from that system between July 2026 and October 31 is affected, according to The Record. The city tells its residents to be wary of emails claiming to come from it. [9]