Arara Message Breach Reaches Osaka and Sega, With 77 Million Addresses at Risk
Security / news
Arara Message Breach Reaches Osaka and Sega, With 77 Million Addresses at Risk
A Japanese email-delivery service shut down on October 31 after attackers used it to send 7.13 million phishing emails. Its clients are still counting what leaked.
Attackers who reached the servers of Arara Message, a Japanese bulk-email service, took address lists its clients had uploaded and sent phishing mail through the service itself. The City of Osaka became the latest victim on Nov. 13 when it said more than 1 million email addresses linked to an online administrative services platform had been exposed, according to The Record.
The platform is maintained by TKC Corporation, which uses Arara to send mail. Anyone who received email from the city's system between July and Oct. 31 may be affected, and Osaka (population 2.8 million) is asking residents not to open links or attachments in messages that claim to come from the city.
What Arara and Paycloud have said
Arara's parent, Paycloud Holdings, disclosed on Nov. 2 that unauthorized access "potentially affected 97 servers and approximately 380 client companies" and that about 77 million email addresses "may have" been exposed, according to eSecurity Planet. Paycloud says the figure counts addresses, not people, and it is still working out how much data was actually removed.
The count has grown. An earlier disclosure covered 61 companies and 3,386,187 addresses, with up to 411,827 customer records at five companies carrying additional personal information. The types of information were not specified.
Arara has given little about the entry point. Its revised explanation cites problems in its system environment alongside a web server vulnerability, and no CVE has been named.
Timeline
| Date (2026) | Event |
|---|---|
| Jul. 2 to Oct. 28 | Window of the 11 Sega newsletters whose recipient lists leaked |
| Oct. 28 to 30 | Up to 7.13 million suspicious emails sent from news@arara.com |
| Oct. 29 | Arara tells Sega no leak is confirmed |
| Oct. 31 | Arara shuts down the whole Arara Message service |
| Nov. 2 | Paycloud discloses 97 servers, about 380 clients, about 77 million addresses |
| Nov. 3 | Arara confirms to Sega that its addresses leaked |
| Nov. 9 | Sega announces 2,196,044 addresses |
| Nov. 13 | Osaka announces more than 1 million |
The phishing came from the vendor's own address
The suspicious emails impersonated credit card companies, with subject lines asking recipients to confirm account usage and billing statements. They went out from Arara's own sender address. Arara says no new suspicious mail went out after Oct. 30.
Sega's account shows how a client learned about it. Sega said on Nov. 9 that 2,196,044 addresses leaked, and that 92,273 of those entries also carried newsletter distribution information whose contents are still unconfirmed. Sega checked with Arara on Oct. 29 and was told no leak was confirmed; the confirmation came on Nov. 3, six days after the first check.
Sega says names, dates of birth, gender, home addresses, phone numbers, credit card information and login passwords were not exposed. Addresses registered to a SEGA Account are not affected because they sit in a separate system.
- Arara first count (61 companies)3.4M addresses
- Sega2.2M addresses
- City of Osaka (at least)1M addresses
Source: eSecurity Planet, Sega via PBX Science, The Record; Osaka figure is stated as 'over 1 million'; accessed 2026-11-14
What it means for the rest of Japan
The Record places the breaches in a wider run. It reports that October accounted for 58% of the year's reported incidents in Japan, and quotes NTT chief cybersecurity strategist Mihoko Matsubara putting stolen personal data at about 380 million pieces so far in 2026. Prime Minister Sanae Takaichi held a cabinet meeting on cybersecurity in early November, and the government announced an emergency package of about $62 million.
Mail that arrives claiming to be from a card issuer, with a subject about billing, is the practical risk for anyone on these lists. Arara says clients must reset administrative passwords, API keys and other credentials before service resumes, and it has told Japan's Personal Information Protection Commission and the police. No reopening date has been announced.
For readers outside Japan, the pattern matches other exploited-vendor stories we have tracked, such as the exploited Cisco BroadWorks flaw and the Outlook spoofing zero-day: the weak point is a supplier, and the victims are its customers. Next up is Arara's promised accounting of what was removed.
Sources
More in Security
- 01PyPI's New Security Tab Grades Releases by Attestation, and Says What It Cannot ProveFour provenance states and two history warnings now sit on every project page, while the package managers that would act on them mostly do not check yet.
- 02Citizen Lab Counts 12 Countries Using Penlink's Webloc Ad-Data TrackingAustria's interior ministry joins the US, El Salvador and Hungary, and a Bloomberg investigation adds eight more; Penlink disputed the April findings.
- 03GPUStack Admin Bypass CVE-2026-102895 Is Exploited, and Patching Will Not Remove the AttackerThe loopback check trusts a spoofable header and defaults to off, and intruders left admin API keys and inference backends that survive an upgrade to 2.2.0.
- 04Chrome 157 Fixes CVE-2026-125350, the Eighth Exploited Zero-Day of 2026Google says an exploit for an XML use-after-free exists in the wild. Four of the eight exploited Chrome bugs of 2026 sit in the V8 engine.