Who this is for: people who receive newsletters or notification emails from companies and organizations that use Arara Inc.'s email delivery service Arara Message (including the ASP repica series), and companies and organizations that use the service. This article is based on the official notices of Arara Inc. and of the client organizations that disclosed impact. It does not cover how the attack was carried out.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who receive newsletters or notification emails from companies and organizations that use Arara Inc.'s email delivery service Arara Message (including the ASP repica series), and companies and organizations that use the service.
- Confirmed so farSee the table ↓
- Personal data taken (client environments)
- Number of email addresses
- Shared environment
6 more
- Environment B
- Period of taking
- Member data items
- Fake email sending
- Service status
- Reports to authorities
- Not yet confirmed
- The split between email-only and with-attributes addresses (under verification)
- The number and names of affected client companies (up to about 380 is an estimate)
- Each company's affected people and items (Arara is notifying clients individually, including those in environment B)
4 more
- The impact on client staff data (names and email addresses of people who use the admin console)
- When and how the intrusion began
- When the service will restart
- The impact on results (still under review)
- What to do nowSee the steps ↓
- Delete emails from news@arara.com that pose as a card company, without opening them
- Do not open links or attachments in emails claiming to come from a sender you subscribe to, for the time being
- Check the table below for the services you use
1 more
- Do not enter passwords or card numbers when asked
- Where to verify (source)All sources ↓
- Arara Inc., "Information leak and service stop due to unauthorized access to Arara Message (third report)" (November 6, 2026)
- Last checked
- As of November 7, 2026 (Japan time; Arara's notice page was last updated at 21:00 on November 6; the next update is planned around 12:00 on November 7 and had not appeared when checked)
Follow-up plans and what we checked
In its third report of November 6, Arara Inc. updated the email address count by adding environment B. It says the split between email-only and with-attributes addresses and the impact on its results are still under review, and the restart date is not set. Its notice page says it is telling each client company of its own impact one by one, starting with those whose results are confirmed.
What email recipients should do today
Arara Inc.'s service is what companies and organizations use to send newsletters and notices. Recipients registered their email address with the sending company or organization, not with Arara, so check whether you are affected through the sender's own notice.
Delete emails from news@arara.com that pose as a card company, without opening them
Arara Inc. says that from October 28 to 30 its service was misused to send up to about 7.13 million fake emails posing as credit card companies. The sender is "news@arara.com" and the subjects include a request to confirm card usage or a usage statement.
It asks recipients not to open the URL in the body and to delete the email. If you entered card information at the link, contact your card issuer right away. The recipients were email addresses a third party brought in from outside, so receiving one is not proof that your address was taken.
Do not open links or attachments in emails claiming to come from a sender you subscribe to, for the time being
Taken addresses and member data could be used for fake emails or SMS in the name of the sending company. Even a message that shows your name or member number may not be real. To check, open the official app or an official site you have bookmarked (see What is phishing? for how to spot fakes).
Check the table below for the services you use
The table below lists each company's notice. A company not in the table may still announce. Check the notices page of the sites whose newsletters you receive from time to time. If an individual notice reaches you, compare it with the notice on the official site rather than relying on the link in the email.
Do not enter passwords or card numbers when asked
Arara Inc. says it does not send emails asking you to enter passwords or card information, and the client companies say similar things. If an email asks you to enter them, check through the official site instead of the email.
The recipient of a fake email is not necessarily an address that was taken
According to Arara Inc.'s second report, the fake emails were sent to "email addresses a third party brought in from outside". The company's service was misused (per the company), so the sender shows as news@arara.com. Conversely, not receiving one does not mean your address was not taken.
Client organizations that disclosed impact
Organizations that use Arara Inc.'s service have published their own notices. The table lists those this site checked by opening each organization's official page between November 5 and 7, and only notices that name Arara Inc. (or its service). They are in order of announcement, oldest first.
Each status follows the organization's own wording. Arara Inc. has not named its client companies. The counts given by each organization cannot be added to or compared with about 81.3 million (and the same person's address may appear in several organizations' counts).
| Organization | What it used the service for (as stated) | Data that may be affected (as stated) | Status | Date |
|---|---|---|---|---|
| Kagoshima Bank, Minami-Nippon Bank, Kagoshima Sogo Shinkin Bank and Kagoshima Shinkin Bank (Pay-don) | Email notifications of the "Pay-don" app (email sending entrusted to Arara Inc.). Email notifications and new sign-ups suspended | Email addresses of Pay-don users and merchants, and payment information (date and time, store name, amount paid). No count given. No secondary harm reported | Possible (the four banks) | Oct 28 |
| Okinawa Prefecture (remote-island exchange project "Shimamaru") | Newsletter (the project's contractor used Arara Message) | 2,560 email addresses. No names or other data leaked | Possible (the prefecture) | Oct 29 |
| Suzuki (Suzuki Media Site) | News releases to media (Arara Inc. handled the email delivery under the site's service provider) | Up to 2,575 registered email addresses. No names or addresses. No misuse or secondary harm confirmed | Possible (the company) | Oct 30 |
| Bic Camera, Kojima and Sofmap (joint notice) | Email delivery entrusted to a contractor; the mail delivery system provided by Arara Inc. | Email addresses and similar data. About 14.9 million in total for the group. Credit card information and online-shop login information are not handled by the service and are out of scope. No specific secondary harm confirmed | Possible (each company) | Nov 2 |
| Osaka Gas ("FitDish" meal subscription) | Emails to "FitDish" customers | 34,489 email addresses (those emailed from October 8 to 29). No names, addresses, phone numbers, card information or purchase data | Leak confirmed (the company) | Nov 2 |
| Kinko's Japan | Newsletter to Smart Membership members | Email addresses (count being checked). Names, membership numbers, registration dates, birthdays and favorite stores: no leak confirmed so far. It had been told its environment was out of scope, then a recheck after the second report confirmed the leak | Leak confirmed (the company); other items not confirmed | Nov 2 |
| Asoview (this site's explainer) | Emails to Asoview! members (member data entrusted to Arara Inc.'s service) | 15,821,184 records. Email addresses, member ID or number, name, gender, date of birth, phone number, postal code, area, ticket purchase and use data, and more. Passwords and card information were not entrusted and are out of scope. Identifying the affected members is still to come | Leak confirmed (the company) | Nov 3 |
| The Yokohama Rubber Co. | News release and news email delivery (via the contractor that handles email delivery) | Registered company names and email addresses. No count given. Arara Inc. had first reported no related leak, then told the company of a leak on November 3 | Leak confirmed (the company) | Nov 3 |
| Workman | The "Workman Online Store newsletter". Notification emails on its online site (including in-app notices) do not use the service and are unaffected | Email addresses, up to about 1.45 million. No other data leaked. It was told on October 29 that members' addresses were not included, then received an urgent phone report of a leak on November 2 (written confirmation pending) | Leak confirmed (the company) | Nov 4 |
| JR Kyushu | Newsletter to people who visited condominium show rooms or requested materials (the contractor that handles delivery uses Arara Inc.'s service) | Names and email addresses. Up to about 13,000. No possibility that addresses or phone numbers leaked. No secondary harm confirmed | Possible (the company) | Nov 4 |
| TKC | Email delivery to customers who use TKC systems (delivery entrusted to Arara Inc.). TKC's services cannot currently send email | Email addresses, up to 2,230,812. Email bodies, My Number and applications to municipalities did not leak. Which customers' addresses is still under investigation (third report) | Leak confirmed (the company) | Nov 4 |
| Bank of the Ryukyus (second report) | The external email service "repica" (provided by Arara Inc.). Delivery suspended | 96,477 email addresses (part of the emails sent from October 8 to 29). No leak of names, addresses, account information or PINs confirmed. Identifying those affected (second report) | Leak confirmed (the bank) | Nov 4 |
| Zaif | Notification emails (Arara Inc.'s service). Delivery temporarily suspended | 380,536 email addresses (excluding duplicates). No names or other attributes, no email bodies, no authentication information. The count of current users is being checked (second report) | Leak confirmed (the company) | Nov 4 |
| IIJ (IIJmio) | Emails to IIJmio customers | 983,458 email addresses (including cancelled contracts). Details of customer attributes are being confirmed with Arara Inc. Card information was not shared with the service and is out of scope | Leak confirmed (the company) | Nov 4 |
| Hasegawa | Arara Inc.'s "repica" servers linked to its email delivery service | 305 email addresses (those emailed from October 8 to 29). Customer data it stores (names, purchase data) and email subjects and bodies are out of scope (first report) | Leak confirmed (the company) | Nov 4 |
| Tribeck | Its email delivery information (delivery logs). The site and member data of its business-forms site "bizocean" and its advertising services (including newsletters) do not use the service and are out of scope | 61,213 records (including duplicates and test emails). Email addresses and merge strings (items set as merge fields, such as names) | Leak confirmed (the company) | Nov 4 |
| Chobirich | Email delivery to members (Arara Message). It stopped sending and notifies members on its site instead | 1,348,525 email addresses (not a count of members). Email address, member number, nickname, date of birth, gender, prefecture of residence and point balance may have leaked. Names, phone numbers, passwords and bank account information were not entrusted and are out of scope. Identifying the affected members is still to come | Possible (the company) | Nov 4 |
| MOS Food Services | Newsletters and other email to "MOS WEB members" ("repica", provided by Arara Inc.) | 7,517,087 records. Email address, age, gender, prefecture of residence and so on. Payment-related information such as credit card details is not included | Leak confirmed (the company) | Nov 4 |
| GMO Payment Service | Arara Message, used by a law firm that is the company's contractor, to send email. Data of people targeted by email delivery from July 20 to October 30, 2026 | Email address only: up to 101,226. Email address, name, billed amount, billing details (store and product used or bought), inquiry number and notice content: up to 5,771. Total up to 106,997 (the company's own figure). People affected are told individually by email. No impact on its own systems and services | Leak confirmed (the company) | Nov 5 |
| CYBIRD | Uses Arara Inc.'s email delivery service for several services. The services and people affected are not yet identified | 98,738 email addresses. The only leaked item Arara has reported to it is email addresses. No unauthorized access to its own services has been confirmed | Leak confirmed (the company) | Nov 6 |
| Pacific League Marketing (email delivery for five Pacific League clubs) | Match-update and other email to paid members of the clubs' official sites who asked for the service, at addresses the clubs emailed since July 1, 2026 (Nippon-Ham, Rakuten, Seibu, Lotte, SoftBank). The five clubs have stopped using Arara Inc.'s service. Orix does not use it | Email addresses only. By club: Nippon-Ham 3,575, Rakuten 1,165, Seibu 2,693, Lotte 2,618, SoftBank 3,660 (the company states a total of 13,711). Fan club member data is out of scope. No secondary harm confirmed. The same notice also describes unauthorized access to the Chiba Lotte Marines' official site, which it treats as a separate matter from Arara | Leak confirmed (the company) | Nov 6 |
Companies told they were not affected were later found to be
The notices of Workman, The Yokohama Rubber and Kinko's Japan say that in the first contact on October 28 or 29 their own environment was reported as out of scope (or no related leak was confirmed), and that they were told of a leak around the November 2 second report. The reason is that the servers where unauthorized access was confirmed widened from the shared environment to client companies' environments. Even if you were first told a service was not affected, that can change in a follow-up.
What happened (from Arara Inc.'s notices)
The following is based on Arara Inc.'s third report of November 6, 2026, its second report of November 2 (its press release, and its parent company's timely disclosure of the same day) and its notice page. In its first report on October 29, it had announced the leak of about 3.01 million email addresses in the shared environment.
October 27
Access that looks like reconnaissance took place (the third report corrects the second report's "October 27 to 28").October 28
A third party logged in to the shared environment's admin console without authorization and took data by misusing functions such as data export. The company made an emergency stop of that environment at 16:31 (second and third reports).October 28
Part of the service's environments was misused and sending of fake emails posing as a card company began (around 3:59). At 7:00 the company stopped outside access to that environment. Fake sending also continued in another environment from around 8:47 (found on October 30).October 29
The company published its first report, filed an initial report with the Personal Information Protection Commission, notified the police and sent an initial report to JIPDEC.October 28 to 31
A third party entered many servers through the service's servers and took database contents (97 servers in client companies' environments). The second report already said October 28 to 31. On November 6 the company corrected the period it had told some clients individually on November 2 ("at some point between October 28 and 29"): data was taken continuously from October 28 until the October 31 stop (timing differs by server). In a separate cloud environment (environment B), credentials were also used without authorization and data was taken in the same period (third report).October 30
The company found the fake sending and cut communication to that environment at 13:26 (no new sending confirmed after 13:32).October 31
In the morning it found the data had been taken through the service. It invalidated the misused credentials, cut communication of each server in turn and stopped all of the service (stop began at 14:50, completed at 19:53). It also invalidated environment B's credentials and stopped environment B (third report).November 2
The company published its second report (its parent filed a timely disclosure the same day). It says it plans to report the newly found items to the Personal Information Protection Commission and send an interim report to JIPDEC.November 6
The company published its third report. It added the 3,249,492 addresses taken from environment B and put the total, with duplicates between categories removed, at 81,329,467. It corrected the shared environment's count to 2,842,400. The same day its notice page corrected the period of taking it had given some clients individually on November 2 ("at some point between October 28 and 29").
Email recipients and members
Registered an email address with the sender (sometimes also a name, member number and so on)
What to do: do not open links in emails in the sender's name
Sending companies and organizations (clients)
Manage the mailing lists and register them with Arara Inc.'s service to send email. They are responsible for the personal data
What to do: confirm whether affected and decide on reporting and notifying
Arara Inc. (Arara Message)
78,102,937 via the service in environment A, 2,842,400 in the shared environment and 3,249,492 in environment B. The total with overlaps subtracted is 81,329,467
Items differ by client; under investigation
- Service
- The email delivery service Arara Message and the ASP repica series. The stopped parts are the Arara Message GUI, API v1 and v2, ASP repica editor, sender and auto-mail, and the BMA error list function. On-premises repica is not covered. The company's other services are not affected
- Category (1): via the service (environment A)
- From October 28 until the October 31 stop, continuously (timing differs by server; the period told to some clients individually on November 2 was corrected on November 6): taking of email addresses and member data confirmed on 97 servers in client environments (up to about 380 companies). The second report said about 77 million (as of November 1); the third report says 78,102,937 (31,346,375 email-only, 46,756,562 with attributes)
- Category (2): shared environment from the first report (environment A)
- October 27 was access that looks like reconnaissance; the unauthorized login and taking were on October 28. 61 client companies. Email addresses and attribute information. The third report corrects the second report's 3,386,187 to 2,842,400 (2,507,311 email-only, 335,089 with attributes) and says some text information was included. The second report's "customer data of up to 411,827 from five companies" is not updated in the third report
- Category (4): environment B (added in the third report)
- From October 28 to 31, credentials were used without authorization to access environment B and 3,249,492 email addresses (email only) were taken. It was not a new intrusion. Environment B is on a different cloud from the service's other servers. At the second report it was under investigation and the count could not be confirmed, so it was not included. Credentials were invalidated and it was stopped on October 31
- Category (3): misuse
- October 28 to 30: up to about 7.13 million fake emails sent from two environments. The sending itself is not confirmed to have leaked anything other than email addresses
- About the counts
- The third report's total of 81,329,467 has the overlaps between categories subtracted (34,285,087 email-only and 47,044,380 with attributes; that split is under verification). Adding the second report's categories as if they had no overlap gives 80,386,187, and the third report is 943,280 more. The count is of email addresses, not people. "Possibly taken" is judged from the amount of records read (second report)
- Items
- Email addresses; items clients registered (name, gender, date of birth, phone number, member number, address and so on, differing by client); and records such as delivery destinations. No credit card numbers are held. The impact on names and email addresses of staff who use the admin console is being checked
- What it says about the cause
- A web server vulnerability and problems in the system environment were involved. When and how the intrusion began is under investigation. It says the series of intrusions appears to be by the same third party as in the earlier report, judging from the common origin of the access
- Restart
- It will decide after identifying the route, changing credentials across the board and confirming system safety. The date is not set (the same in the third report). At restart it plans to ask clients to reset admin console passwords and credentials such as API keys
- Contact
- Support line for client companies 03-5414-3611. It is for direct customers only; those who contracted through a reseller should contact the reseller (from the notice page)
What is known and what is not
Status as of November 7, 2026. When there is news, the status column of this table will be rewritten.
| Item | What the notice says | Status |
|---|---|---|
| Personal data taken (client environments) | Taking of email addresses and member data confirmed on 97 servers (including data that may have been taken; second report) | Leak confirmed (the company; includes possible) |
| Number of email addresses | 81,329,467 with duplicates between categories removed (third report). The second report said about 77 million. Not a count of people. The split into 34,285,087 email-only and 47,044,380 with attributes is under verification | Confirmed (the company; split under verification) |
| Number of affected client companies | Up to about 380 (the second report's estimate; the third report explains it includes the 61 in the shared environment and those in environment B). Names not published | Under investigation |
| Shared environment | 61 client companies, 2,842,400 (excluding duplicates; corrected from 3,386,187 in the second report and updated from about 3.01 million in the first). The second report's customer data of up to 411,827 from five companies is not updated in the third report | Leak confirmed (the company) |
| Environment B | 3,249,492, email addresses only. During the same series of access from October 28 to 31; not a new intrusion. Credentials invalidated and stopped on October 31 | Leak confirmed (the company) |
| Period of taking | October 27: access that looks like reconnaissance. Unauthorized login and taking from October 28 until the October 31 stop, continuously (differs by server). The "some point between October 28 and 29" given to some clients individually on November 2 was wrong and was corrected on November 6 (the published second report said October 28 to 31) | Confirmed (the company) |
| Member data items | Name, gender, date of birth, phone number, member number, address and so on (differ by client), and records such as delivery destinations | Leak confirmed (the company; items differ by client) |
| Credit card numbers | Not held by the service at all (second and third reports) | Not included (the company) |
| Admin console and API credentials | Misused credentials were invalidated. It plans to ask clients to reset at restart. In the second report's table, the relevant cells say "use suspended" (via the service) and "not applicable" (shared environment), and do not say whether they were taken | Not stated |
| Client staff data | The impact on names and email addresses of admin console users is being checked | Under investigation |
| Fake email sending | October 28 to 30, up to about 7.13 million from two environments. Sender news@arara.com. Recipients were addresses a third party brought in from outside | Confirmed (the company) |
| Cause | A web server vulnerability and problems in the system environment. Start and route under investigation | Under investigation |
| Misuse of leaked data | Not stated by Arara. Bic Camera, Kojima and Sofmap, Asoview and Zaif say in their notices that no secondary harm or misuse is confirmed at present | Not confirmed (each company) |
| Service status | All services stopped on October 31. Restart date not set (third report). Scheduled sends are not executed | Confirmed (the company) |
| Reports to authorities | Personal Information Protection Commission: initial report on October 29, interim report on November 2, additional report planned for November 6. Ministry of Internal Affairs and Communications (Kanto Bureau of Telecommunications): reported on November 4, additional report planned for November 6. Police notified on October 29. JIPDEC: initial report on October 29, interim report on November 4, additional report planned for November 6 | Confirmed (items up to November 4; the November 6 additional reports are stated as planned) |
| Impact on results | Still under review (third report) | Under investigation |
Each company's count cannot be compared with about 81.3 million
81,329,467 (about 81.3 million) is the count of email addresses Arara Inc. gave for the whole incident, with duplicates between categories removed. Counts such as Workman's up to about 1.45 million or Asoview's 15,821,184 may be part of it, but which companies make up how much has not been published. The counts are measured differently, so do not add or subtract them.
What email addresses and member data can be used for
In general, the following combinations allow the following kinds of misuse. This does not mean it happened here.
- Email address plus the sender's name: fake emails in that company's name arrive at the same address as the real newsletter, and people tend to assume it is the usual sender
- Name plus phone number plus address: fake emails and SMS that use the real name, and fake identity checks by phone
- Member number plus name plus date of birth: posing as a member service and asking for more data under the pretext of "identity verification"
- Usage history (ticket types bought, facilities used, payment dates and amounts): material for plausible "cancellation" or "refund" messages based on real bookings and payments
The incidents of October 2026 at Ymirlink's email delivery service, Cuenote FC, and at Blastmail were also cases where the addresses of many organizations leaked from one delivery service. In each, you checked whether you were affected through the notices of the organizations whose emails you receive.
What companies and organizations using Arara Message should do
Arara Inc. says it will contact all client companies promptly after its second report, individually telling each whether its environment is affected and what data leaked. In the third report it says it will also contact individually the clients that used environment B. As the table shows, there are cases where a company first told it was not affected was later found to be.
Confirm whether your environment is affected, through Arara Inc.'s individual contact and its support line
Do not just wait for its contact; ask the client support line (03-5414-3611, for direct customers only; through a reseller, ask the reseller). Compare the items and counts it gives you with the items you registered in the delivery system.
For reporting to the Personal Information Protection Commission, check the deadline for joint reporting (6 p.m. on November 9)
Arara Inc. says private companies and organizations can report jointly with it, and government agencies and local governments can have it report on their behalf, to the Personal Information Protection Commission. The application deadline is 6 p.m. on Monday, November 9, 2026. If you apply, you do not need to report yourself, and it says it has confirmed with the Commission that exceeding the guideline period for the initial report will not be treated as late reporting. If you report on your own, you do not need to apply.
Joint reporting does not cover JIPDEC reports by holders of the Privacy Mark; those you handle yourself. The procedure is on its guidance page. For whether you must notify the people concerned, consult the Commission's help desk or an expert.
If you were given a period of taking on November 2, correct it to the revised period
According to Arara Inc.'s notice page, the period it gave some clients individually on November 2 ("at some point between October 28 and 29") was wrong. The correct period is continuous taking from each server from October 28 until the service was stopped on October 31 (timing differs by server). If you used the earlier period in a report to the Personal Information Protection Commission or in an internal briefing, change it to the corrected period.
Scheduled sends are not executed while the service is down; move important messages to another channel
According to the notice page, while the service is stopped the admin console and API cannot be used, and emails already scheduled are not sent. Bills, deadlines and campaigns you scheduled will not arrive. Announce important messages by other means, such as posting on your official site or app notifications. Some companies, like TKC and Hasegawa, are already switching to another email delivery platform.
Review your own credentials before restart
Arara Inc. plans to ask clients to reset admin console passwords and credentials such as API keys at restart. As this site's advice, check beforehand whether the same password is used on other services and whether the API key is written into other systems or configuration files; the reset will go faster.
Warn your recipients
In their notices, the companies in the table all ask recipients not to open links in suspicious emails in their name. It helps not to put links in the warning email itself, and to say that while delivery is stopped, emails that arrive are likely fake.
This site's view: when the delivery system stops, communication that relies only on email stops
In this case, besides the data leak, the service has stopped entirely and scheduled sends are not executed. Companies in the table are affected to different degrees: "email notification function suspended (Pay-don)", "notification emails temporarily suspended (Zaif)", "TKC's services cannot send email".
List what you send by email, by type
Separate billing and deadline notices, authentication codes, booking confirmations and campaigns, and mark those that would cause trouble if the delivery system were down for several days.
Decide on a fallback before it stops
Decide beforehand on a separate delivery platform that does not rely on the same provider, a notice on your official site, and app notifications. If you start looking for a switch only after the stop, communication has a gap in the meantime, as in the companies in the table.
Keep the items you register in the delivery system to a minimum
As the table shows, the impact in the same incident ranges from companies that held only email addresses to those that registered names, dates of birth and purchase data. Stop registering any item you do not use for merge fields or segmentation.
Sources (public record)
The facts in this article are based on the following public information. We do not speculate about attack methods that have not been disclosed.
- Arara Inc., "Information leak and service stop due to unauthorized access to Arara Message (third report)" (November 6, 2026) — arara.com
- Arara Inc., "[Important] Apology and report on the service stop and leak of personal information of Arara Message" (notice page updated November 6, 2026, 21:00; checked November 7; includes the correction of the period of taking) — am.arara.com
- Arara Inc., "Information leak and service stop due to unauthorized access to Arara Message (second report)" (November 2, 2026) — arara.com
- Arara Inc., "Guidance on joint reporting and reporting on behalf to the Personal Information Protection Commission" — am.arara.com
- PayCloud Holdings Co., Ltd., "Information leak and service stop due to unauthorized access to Arara Message provided by a consolidated subsidiary (second report)" (November 2, 2026, timely disclosure) — xj-storage.jp
- Kagoshima Bank and three other institutions, notice on the possible leak of personal information due to unauthorized access to Pay-don (October 28, 2026) — kagin.co.jp
- Okinawa Prefecture, notice on the possible leak of information through unauthorized access to the newsletter delivery service of the remote-island exchange project "Shimamaru" (October 29, 2026) — pref.okinawa.jp
- Suzuki Motor Corporation, "Possible leak of personal information at a contractor" (October 30, 2026) — suzuki.co.jp
- Bic Camera, Kojima and Sofmap, apology and notice on the leak of newsletter registrants' data through unauthorized access to a contractor (November 2, 2026) — biccamera.com
- Osaka Gas Co., Ltd., "Leak of customer information through unauthorized access to a contractor's email delivery service" (November 2, 2026) — osakagas.co.jp
- Kinko's Japan Co., Ltd., apology and notice on the leak of customers' email addresses through unauthorized access to Arara Message (first report, November 2, 2026) — kinkos.co.jp
- Asoview, Inc., "Apology and notice on unauthorized access to a contractor's email delivery service" (November 3, 2026) — asoview.co.jp
- The Yokohama Rubber Co., Ltd., "Leak of personal information at the email delivery service we use" (November 3, 2026) — y-yokohama.com
- Workman Co., Ltd., apology and request on the leak of Workman Online Store newsletter members' email addresses (November 4, 2026) — workman.co.jp
- Kyushu Railway Company, notice on the possible leak of email addresses through unauthorized access to a partner's email delivery service (November 4, 2026) — jrkyushu.co.jp
- TKC Corporation, "Information leak through unauthorized access to an email delivery contractor (third report)" (November 4, 2026) — tkc.jp
- The Bank of the Ryukyus, "Leak of customers' email addresses through unauthorized access to a contractor's email delivery service (second report)" (November 4, 2026) — ryugin.co.jp
- Zaif, "Information leak through unauthorized access to a contractor (second report, November 4, 2026)" — corp.zaif.jp
- Internet Initiative Japan Inc., "Leak of customer information through unauthorized access to the email delivery service we use" (November 4, 2026) — iij.ad.jp
- Hasegawa Co., Ltd., "Apology and notice on the leak of personal information through unauthorized access to an email delivery contractor (first report)" (November 4, 2026) — hasegawa.jp
- Tribeck Corporation, apology and notice on the leak of personal information through unauthorized access to Arara Inc. (November 4, 2026) — tribeck.jp
- Chobirich Co., Ltd., apology and notice on unauthorized access to a contractor's email delivery service (November 4, 2026) — chobirich.co.jp
- MOS Food Services, Inc., apology and notice on the leak of customer information through unauthorized access to a contractor's email delivery service (November 4, 2026) — mos.co.jp
- GMO Payment Service, Inc., "Leak of personal information through unauthorized access at Arara Inc." (November 5, 2026) — gmo-ps.com
- CYBIRD Co., Ltd., "[Important notice] Apology and notice on the leak of personal information through unauthorized access to an email delivery service (Arara Inc.)" (November 6, 2026) — cybird.co.jp
- Pacific League Marketing, Inc., "Apology and notice on the leak of customers' email addresses through unauthorized access" (November 6, 2026; press release as published on Sportsmania) — sportsmania.jp
- Personal Information Protection Commission, "Responding to leaks and helpful materials" — ppc.go.jp
Update history
2026-11-07: Reflected the third report of November 6: the email addresses taken change from about 77 million to 81,329,467 (about 81.3 million) with duplicates between categories removed. It adds the 3,249,492 from a separate cloud environment (environment B), the correction of the shared environment's count (3,386,187 to 2,842,400) and the correction of the period of taking that had been told to some clients individually on November 2 (continuous from October 28 until the October 31 stop), and adds Tribeck, Chobirich, MOS Food Services, GMO Payment Service, CYBIRD and Pacific League Marketing to the client table. The notice page was last updated at 21:00 on November 6; the update planned for around 12:00 on November 7 had not appeared when checked.
2026-11-05: First version. Based on Arara Inc.'s second report of November 2 (about 77 million, up to about 380 companies, up to about 7.13 million fake emails) and the official notices of 15 client organizations. The notice page was last updated at 21:00 on November 4; the update planned for around 12:00 on November 5 had not appeared when this article was written.
Read next
- Similar cases: Unauthorized access to Ymirlink's Cuenote FC / Unauthorized access to Blastmail / JR East, View Card and JR Kyushu email address leak
- An individual client's explainer: Asoview member data leak
- Spotting fake emails: What is phishing? / Spam from your own email address
- Checking senders (for operators): SPF, DKIM and DMARC basics
- Other 2026 incidents: Data breaches and cyberattacks of 2026 (Japan and worldwide)