Actively exploited Security news
Arara Message breach: 81 million email addresses stolen and phishing sent in card issuers' names
An attacker broke into Arara Message, a Japanese bulk email delivery service, took more than 81 million email addresses belonging to the customers of roughly 380 companies, and used the service itself to send up to 7.13 million phishing emails posing as credit card companies. The fallout is now reaching downstream customers: on 13 November 2026 the City of Osaka disclosed that 1.08 million addresses of users of its online services system were exposed. Here is what is confirmed and what it means for defenders and users.
Key points
- Arara Inc., part of Paycloud Holdings, confirmed unauthorized access to its Arara Message email delivery service. Its third report of 6 Nov 2026 puts the exposure at 81,329,467 unique email addresses across up to roughly 380 business customers.
- Depending on the customer, names, gender, dates of birth, phone numbers, member IDs and postal addresses may also have been taken. Arara says the service does not store payment card numbers.
- The attacker abused the service to send up to 7.13 million emails from news@arara.com on 28-30 Oct impersonating credit card companies. Arara suspended all services on 31 Oct; an outside firm is still investigating how the attacker got in.
- Downstream customers are now reporting impact: local government software vendor TKC cited up to 2,230,812 addresses, and the City of Osaka on 13 Nov reported 1,078,713 addresses of users of its online system. TKC and Osaka say only email addresses were involved in their case.
What happened
Arara Message is a Japanese bulk email delivery service that companies and software vendors use to send notifications and newsletters to their customers. It is run by Arara Inc., part of Paycloud Holdings. An unknown third party gained access to it, and the company has disclosed the incident in three reports since 29 October 2026.
According to the third report, published on 6 November, 81,329,467 unique email addresses may have been taken (a count of addresses, not people):
- 78,102,937 addresses through unauthorized access to the service itself,
- 2,842,400 addresses from a shared environment described in the first report (the second report said 3,386,187; the figure was later revised down),
- 3,249,492 addresses from a separate cloud environment that the investigation only identified in the third report.
Up to roughly 380 business customers are affected (the number is still under review), including 61 on the shared environment. Depending on what each customer uploaded, names, gender, dates of birth, phone numbers, member IDs and postal addresses may also have been exposed. Arara says Arara Message does not hold payment card numbers.
The attacker also abused the service directly: between 28 and 30 October up to 7.13 million emails were sent from news@arara.com, posing as credit card companies and asking recipients to confirm transactions. Arara suspended all services on 31 October; restoring them depends on closing the intrusion path, a safety review by an outside firm and resetting customers' credentials.
The breach is reaching downstream customers
Arara has not published its customer list, but organizations that used the service are disclosing the impact themselves:
- TKC Corporation, which builds software for local governments and accountants, said in its third report on 4 November that up to 2,230,812 email addresses of its systems' users were exposed. Arara's follow-up investigation found that only addresses leaked - not email bodies, My Number national ID numbers or application data. TKC cannot currently send email and is moving to another platform.
- The City of Osaka (2.8 million residents) on 13 November disclosed that 1,078,713 email addresses of users of its online administrative services system, run by TKC, were exposed. It covers anyone who received email from
info-osaka-online@city.osaka.lg.jpbetween 1 July and 31 October 2026 (registration, password changes, sign-ins, application status, and a notice sent to all users on 16 September). The city says no other data was involved and is still deciding whether to notify individuals.
Technical details
Arara has not disclosed how the attacker got in; an outside specialist firm is investigating. The reports only show that the attacker could reach the service itself - both customers' mailing lists and the ability to send - and that data sat in more than one cloud environment, one of which was found only later. Access like this commonly comes from stolen administrator or API credentials, but that is our general observation, not a finding by Arara. It is why Arara will reset all customers' credentials before bringing the service back.
Who is affected
- Recipients of email from companies and public bodies that sent through Arara Message, or through suppliers built on it - mainly in Japan, based on the customers named so far.
- Organizations using Arara Message directly or indirectly (through a supplier such as TKC). Many organizations don't know which delivery service their SaaS vendors use to send email.
How to tell if you were affected
Arara has not published indicators such as hashes or IP addresses. These markers are confirmed:
news@arara.com # phishing sender 28-30 Oct 2026 (impersonating card companies)
info-osaka-online@city.osaka.lg.jp # legitimate City of Osaka sender - anyone who got mail from it 1 Jul-31 Oct 2026 is in the leak- Mail administrators can search gateway logs for messages from
news@arara.comdelivered on 28-30 October and check who clicked. - Arara's customers should expect targeted phishing in their brand's name and watch customer reports.
What to do
Users:
- Delete emails "from your card company" asking you to confirm transactions and don't open the links. If you entered card details into such a form, call your card issuer right away (Arara's advice).
- Be careful with emails, texts and calls in the name of any public body or company you regularly hear from. Never enter passwords, PINs or card numbers through a link in an email, and check information on the official website instead (Osaka's advice).
- Check a suspicious link first with our link checker.
Organizations:
- Find out which delivery service your email goes through, including at suppliers and SaaS vendors. Email delivery platforms are part of your supply chain and hold exactly the data an attacker needs for convincing phishing.
- If you use Arara Message, expect the credential reset Arara requires before service resumes, and check your breach notification obligations.
- Tell customers what your genuine emails look like, and review SPF, DKIM and DMARC (
p=reject) so attackers can't send in your domain's name.
Timeline
Updates
- 13 Nov 2026: first version.
FAQ
Does this affect people outside Japan?
Arara Message is a Japanese service, and the customers named in primary sources (TKC, the City of Osaka) are Japanese. Arara has not published the full list of roughly 380 customers, so people abroad who receive mail from Japanese companies could be among the addresses. The broader lesson applies everywhere: a leak of email addresses tied to a specific sender enables highly convincing phishing in that sender's name.
Only my email address leaked. Why does it matter?
The attacker knows which company or public body you hear from and can send a believable scam in its name. With Arara that already happened - more than 7 million phishing emails went out from the service itself. For some customers names, phone numbers or postal addresses were exposed too, which opens the door to SMS and phone scams.
How can I tell the email is a scam?
Be suspicious of requests to confirm payments, sign in or enter card details through a link in an email. Osaka and Arara give the same advice: don't click links, don't open attachments, don't pay anything, and check information on the official website. You can check a suspicious link with our link checker first.
Sources
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
FBI disrupts North Korea's FaceStealer fake video call campaign as the US moves to seize $1.2 billion from the Binance theft
On 12 November 2026 the US Department of Justice announced two actions against North Korean cryptocurrency theft. The FBI disrupted cloud infrastructure behind FaceStealer, a campaign that lures crypto workers and open-source developers into fake video calls and installs malware disguised as a fix for an audio problem. Separately, a court authorised the seizure or restraint of more than $1.2 billion from the theft of over $6 billion from Binance on 29 October. Here is how the trick works and what to do if you joined one of these calls.
Actively exploited
Trezor confirms hidden implants in three Safe 5 wallets sold by CryptoBilis; firmware 2.13.1 neutralises them
Hardware wallet maker Trezor confirmed on 12 November 2026 that three Trezor Safe 5 units sold through the Asian reseller CryptoBilis contain an extra circuit board between the main board and the display. The board copies the recovery phrase whenever it appears on screen and sends it, encrypted, over the mobile network to the attackers. Firmware 2.13.1 shuts these implants down, but it cannot protect a phrase that was captured earlier. Anyone who bought a Trezor from CryptoBilis since March 2026 should move their funds to a new wallet with a new phrase.
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.