Email delivery service Arara Message breached, about 77 million addresses and up to about 380 companies: what to check this week if you outsource email

Key points for company leaders

This article reflects information available on the morning of 4 November 2026 (Japan time). Arara is still checking the figures and says it will share the results in a third report. For the latest, check the announcements listed in the sources at the end.^[1]

• About 77 million addresses, up to about 380 companies

  Between 28 and 31 October an outsider went through an Arara Message server into many other servers and took database contents. The 97 servers hold client companies' environments, and about 77 million email addresses were taken or may have been (still being checked). The company notes this is not a count of people, since one person may have several addresses.^[1]

• More than email addresses

  The data includes items client companies registered, such as names, gender, dates of birth, phone numbers, member numbers and addresses (these vary by company), plus delivery records. The company says its service holds no credit card numbers.^[1]

• The platform itself sent scam emails

  From 28 to 30 October the service was abused to send up to about 7.13 million suspicious emails posing as a credit card company, from news@arara.com. The whole service was shut down on 31 October, with no date set for restarting it.^[1]

• What to do this week

  Check whether your company or its contractors use Arara Message, and if so, confirm through Arara's individual notice whether your environment is affected. Tell customers and staff not to open links in emails or texts that claim to come from you, and not to enter IDs or card details.^[1]

What happened

Arara Message is a service companies use to send bulk email to their members and customers. In its first report on 29 October, Arara said about 3.01 million email addresses had leaked from one environment (a shared environment). Its second report on 2 November said more servers had been found compromised and that client companies' member data had also been taken.^[1]

In the shared environment, an outsider logged in to the admin screen without authorisation on 27 and 28 October and used features such as data export to take data. After re-investigation the figures were updated to 3,386,187 email addresses with duplicates removed (61 client companies), including up to 411,827 customer records with names or company names registered by five of them. The company says the cause was not only the web server vulnerability it first reported but also problems in its system environment. When and how the intrusion began is still under investigation, and the attacks appear to come from the same outsider, based on shared attack sources and other signs.^[1]

Why so many companies are affected

Companies hand member addresses and names to email delivery services so the services can send their mail. When one delivery provider is breached, many companies' customer data is affected at once, even if their own systems are fine. In this case Arara estimates up to about 380 companies.^[1]

Client companies are now making their own announcements. TKC, which provides systems for accounting firms, companies and local governments, said in its second report on 2 November that up to 2,230,812 email addresses of customers using its systems were among the data leaked from Arara, which handles its email delivery.^[2]

Handling the suspicious emails

According to Arara, the suspicious emails went to addresses the outsider brought in from elsewhere, and no leak beyond email addresses has been confirmed from this sending itself. Subject lines included "利用内容確認のご依頼" (request to confirm usage) and "ご利用明細確認のご依頼" (request to confirm your statement).^[1]

What to check at your company

• Checked whether your company and key contractors use Arara Message, directly or indirectly^[1][2]
• Prepared a customer notice and contact point in case you are affected, with IPA's helpdesk as a referral if needed^[3]
• Told customers and staff not to enter IDs or card details in response to emails, texts or calls that claim to come from you or your partners^[1]
• Turned on multi-factor authentication for your email delivery admin screens, and reviewed where API keys are stored and what they can do
• Cut the customer fields you share with delivery services down to what sending actually needs
• Checked how you would send essential emails, such as sign-up or payment confirmations, if your delivery service stopped^[1]

Common questions

How ZeroKai can help

Arara's second report names a web server vulnerability and unauthorised logins to an admin screen as entry points. Knowing everything your company exposes to the internet, in one list, is the first step to fewer blind spots. ZeroKai takes your domain, lists the host names recorded in Certificate Transparency logs and highlights names that look like admin screens or test environments. For domains whose ownership you have verified, it also shows exposed remote access, file sharing, database and FTP services observed by Shodan.