EXPLORINEER
en

JP — ITmedia

Mos Burger, Workman, IIJmio Among Firms Announcing Customer Data Leaks from Unauthorized Access to Ararа

Security2 min read

A mail-delivery company called Arara was hacked, and many companies that use its service have announced that customer data leaked. Some of them reported millions of email addresses stolen.

What happened

Hackers broke into Arara, a company that sends marketing emails for other businesses. Many of its client companies, including Mos Food Services (Mos Burger), Workman, IIJ, and Sumitomo Realty, then announced that customer information had leaked. Arara says up to about 380 client companies may be affected. Arara also said the hackers used its service to send up to about 7.13 million fake emails pretending to be from credit card companies. Arara stopped its whole service on October 31, and it has not said when it will restart.

Key numbers

  • Mos Food Services: 7,517,087 records, including email addresses, age, gender, and prefecture. No credit card data was included.
  • Workman: up to about 1.45 million email addresses from its online store newsletter.
  • IIJmio (a low-cost mobile phone plan): 983,458 email addresses.
  • Arara estimates that about 77 million email addresses may have leaked from 97 company servers.
  • Some companies reported more than 10 million records. Bic Camera and 2 other companies said about 14.9 million records may have leaked, and Asobu reported 15,821,184 records.

Some companies changed their story

Some companies first said they were not affected, then later admitted that data had leaked. Matsutake Multiplex Theaters first said its member data was safe, but on November 2 it reported that 3,323,050 member email addresses had leaked after Arara found another system had been hacked. Yokohama Rubber and Subway also changed their earlier statements.

Why it matters

Millions of people may now get spam or scam emails that look real. Because many companies share one provider, one hack can affect many brands at once. People who receive strange emails about cards or accounts should be careful and not click unknown links.

What to watch

  • How many companies will report leaks as Arara's investigation continues.
  • Whether the final number of affected records goes up or down.
  • When Arara's service will restart, and what security changes it will make.
  • Whether companies that first said they were safe report new leaks.

Glossary

Arara
A company that runs an email delivery service. Hackers broke into it, and many other companies were affected.
IIJmio
A low-cost mobile phone plan from IIJ, a Japanese internet company.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityITmedia

Strengthening Cybersecurity at Medical Institutions: Long-Term Risks to Patient Care from Ransomware Attacks

Japan's Ministry of Health, Labour and Welfare plans to significantly strengthen cybersecurity at medical institutions next fiscal year, requesting 13.7 billion yen for the project in its FY2027 budget request, up from 100 million yen in the FY2026 initial budget. A ransomware attack can make electronic medical records unusable for long periods and disrupt patient care, and the ministry's survey found many hospitals have numerous external connection points that are hard to manage and lack cybersecurity specialists. The ministry will support consolidation of external connections, use of specialists listed by IPA, and initial response to incidents.

Securityheise online

Patch now! Attacks on Zyxel switches observed

Admins must install current security updates to stop ongoing attacks on Zyxel GS1900 switches, as attackers can otherwise access devices and copy credentials. The flaw (CVE-2026-107441, CVSS 8.8, rated "high") can be exploited without authentication from the local network via a crafted HTTP request, and patches are provided only for models still within their support period. Researchers at Binarly found that the exploit used against the earlier CVE-2026-7273 also worked on the firmware meant to fix it, and the Canadian Cyber Centre has also warned of exploitation.

SecurityVnExpress

Hackers attack refrigeration systems at France's blood bank

Hackers targeted a refrigeration equipment supplier, raising storage temperatures at France's national blood agency (EFS) from -30°C to 110°C in three facilities in Bourgogne-Franche-Comté. A night-shift staff member noticed the abnormal rise and technical staff acted before any blood samples or products were damaged. EFS moved its products to other storage sites and is working with France's cybersecurity agency and the Ministry of Health on the investigation.

SecurityITmedia

Failure to Notice a Published Vulnerability Led to Leak of 396,920 People's Data; Recruiting Service ApplyNow Also Exposed Some My Numbers and Bank Account Information

ApplyNow, a Tokyo-based recruiting service provider, announced on November 4 that the personal information of 396,920 people was leaked through unauthorized access to its services first disclosed on September 9. Some records included My Number, basic pension numbers, and bank account details, while credit card information and identity document images were not affected. The company attributed the breach to failing to apply a vendor-published patch to an internal data analysis tool in time, and it has since applied the fix and restricted access to specific IP addresses.