JP — ITmedia

Asoview Leaks Data of 15.82 Million Members, Including Last Login Dates and Facilities Used, Via Email Contractor Arara Unauthorized Access

SecurityNovember 4, 20261 min read

Asoview, a big Japanese leisure booking site, says data on about 15.82 million members leaked. The leak came through Ararа, a company that sends its emails, after hackers broke into Ararа's service.

What happened

Asoview runs a booking site for theme parks, aquariums, outdoor fun and more. It hired a company called Arara to send its emails. On November 3, 2026, Asoview said someone broke into Arara's email service and stole member information. The leaked data includes email addresses, names, the last day a member logged in, and the facilities they used. Asoview says passwords and credit card details were not leaked, because it did not give them to Arara.

Key numbers and facts

About 15,821,184 member records leaked.
Asoview has more than 23 million members.
The site lists about 28,000 plans.
Asoview stopped all emails sent through Arara's service on November 2, 2026.
Arara is still checking which member each leaked email address belongs to.

Background

Asoview lets people book tickets for places like amusement parks and outdoor activities, both on its website and in its app. Many companies use outside firms to send emails. This means a problem at one outside firm can expose data from many different companies.

Why it matters

This is a very large leak, and it affects millions of people. Leaked data such as ticket purchases and login dates can be used to send scam messages. Asoview says it will check how it picks outside partners and limit the data it shares with them.

What to watch

Whether Arara finds out which members were affected.
When Asoview contacts affected members one by one.
Whether Asoview finds any break-in to its own systems.
Any new rules Asoview sets for outside companies.

Glossary

Asoview: A Japanese website and app where people book leisure activities, such as theme parks, aquariums, and outdoor fun.
Arara: A company that runs the email delivery service called Arara Message, which Asoview used to send emails to members.

China-linked hackers launch AI-driven attacks on over 200 organizations worldwide, targeting US chip and defense firms

According to CrowdStrike's threat analysis report, the China-linked hacking group "VAPOR PANDA" carried out AI-based cyberattacks against at least 14 countries over 11 days starting on the 17th of last month. The attacks used the Chinese large language model DeepSeek and the AI-based intrusion tool "ARTEX," which was originally an open-source penetration testing tool that attackers have misused. Targets included US pharmaceutical, chip, defense, nuclear and financial firms, as well as telecom operators in the US, Belgium and the Philippines.

SecurityITmediaNov 4

Up to 77 Million Email Addresses Possibly Leaked in Arara Message Breach; Attackers Breached Client Company Servers

Paycloud Holdings said on November 2 that about 77 million email addresses may have been leaked or exposed in the unauthorized access to its subsidiary Arara's email delivery service "Arara Message," with up to about 380 contracted companies affected. Attackers reportedly entered contracted companies' systems via Arara Message servers between October 28 and 31, taking data from 97 servers, and were also found to have sent up to about 7.13 million phishing emails impersonating credit card companies. The service has been fully suspended since October 31, with no restart date set.

SecurityITmediaNov 4

GMO Payment Gateway reports "unauthorized user activity" in payment support system; 69 Vpreca records leaked, 3 including security codes

GMO Payment Gateway said on November 2 that unauthorized user activity occurred on October 30 in its Issuing Support Service, which is provided to credit card companies, leaking information on 69 users of Life Card's Visa prepaid card "Vpreca." For three of these, the Vpreca card number, security code, expiration date and name may have been stolen, though Life Card has not confirmed any unauthorized use and closed those accounts on October 31.

SecurityTechCrunchNov 4

Researchers warned of North Korean hacking tactics years before record $6.3B Binance heist

Binance says North Korean hackers posed as recruiters and used a fake coding assignment over a months-long scheme to install malware on a software engineer's work laptop, which gave them a foothold to steal a record $6.3 billion in crypto. The company said its security tools did not detect the malware and that it has since improved its network security. Researchers and governments had warned for years about North Korean social engineering tactics targeting the crypto industry.