EXPLORINEER
en

JP — ITmedia

Up to 77 Million Email Addresses Possibly Leaked in Arara Message Breach; Attackers Breached Client Company Servers

Security2 min read

A Japanese company, Payckloud Holdings, says a hacking attack on its email delivery service "Arara Message" may have leaked about 77 million email addresses. The service has been shut down since October 31, and the restart date is not yet known.

What happened

Payckloud Holdings said on November 2 that hackers broke into Arara Message, an email service run by its subsidiary Arara. About 77 million new email addresses were leaked or may have been leaked. Up to about 380 client companies could be affected. The company had already reported a leak of about 3.01 million addresses on October 29. The attackers went from the shared system into client companies' systems through Arara Message's servers. They also used the service to send up to about 7.13 million fake emails that looked like they came from credit card companies.

Key numbers

  • About 77 million email addresses and member records taken from 97 servers (October 28 to 31)
  • The earlier leak rose from about 3.01 million to 3,386,187 addresses
  • Up to 411,827 customer records from 5 client companies may also have leaked
  • Up to about 7.13 million phishing emails were sent between October 28 and 30
  • Asobyu, a leisure booking service, said 15,821,184 member records leaked

Background

Arara Message is an email delivery service. Companies use it to send mail to their customers. The attackers first got into a shared system. From there, they moved to other servers and then into client company systems. Some of the problems came from weak points in a web server and from problems in how the system was set up. The company cut off login details that the attackers had used, blocked server traffic, and stopped the whole service.

Why it matters

This is one of the largest known leaks of email addresses in Japan in this case. Many people may now get fake emails that look real. The company warns people not to click links in emails that ask them to check their account or statement. The leak also affects other companies, such as Asobyu, which had its own member data taken.

What to watch

  • The final count of leaked records, which the company says is still being checked
  • How the attackers got in, and what the company finds
  • When and whether Arara Message restarts
  • Whether more client companies report leaks

Glossary

Arara Message
An email delivery service that companies use to send mail to their customers.
Arara
A subsidiary of Payckloud Holdings that provides the Arara Message service.
Payckloud Holdings
The parent company of Arara, which announced the leak.
Asobyu
A company that runs Asobyu!, a leisure and experience booking service, which also had member data leaked.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

Security전자신문

China-linked hackers launch AI-driven attacks on over 200 organizations worldwide, targeting US chip and defense firms

According to CrowdStrike's threat analysis report, the China-linked hacking group "VAPOR PANDA" carried out AI-based cyberattacks against at least 14 countries over 11 days starting on the 17th of last month. The attacks used the Chinese large language model DeepSeek and the AI-based intrusion tool "ARTEX," which was originally an open-source penetration testing tool that attackers have misused. Targets included US pharmaceutical, chip, defense, nuclear and financial firms, as well as telecom operators in the US, Belgium and the Philippines.

SecurityITmedia

Asoview Leaks Data of 15.82 Million Members, Including Last Login Dates and Facilities Used, Via Email Contractor Arara Unauthorized Access

Asoview announced on November 3 that unauthorized access to Arara's email delivery service, which it used to send member emails, led to the leak of 15,821,184 member records. The leaked data includes email addresses, names, last login dates, facility names, ticket purchase details, and other information, while passwords and credit card information were not leaked. Asoview has halted all email delivery through Arara's service and invalidated authentication credentials, and it plans to notify affected members individually after matching the leaked data.

SecurityITmedia

GMO Payment Gateway reports "unauthorized user activity" in payment support system; 69 Vpreca records leaked, 3 including security codes

GMO Payment Gateway said on November 2 that unauthorized user activity occurred on October 30 in its Issuing Support Service, which is provided to credit card companies, leaking information on 69 users of Life Card's Visa prepaid card "Vpreca." For three of these, the Vpreca card number, security code, expiration date and name may have been stolen, though Life Card has not confirmed any unauthorized use and closed those accounts on October 31.

SecurityTechCrunch

Researchers warned of North Korean hacking tactics years before record $6.3B Binance heist

Binance says North Korean hackers posed as recruiters and used a fake coding assignment over a months-long scheme to install malware on a software engineer's work laptop, which gave them a foothold to steal a record $6.3 billion in crypto. The company said its security tools did not detect the malware and that it has since improved its network security. Researchers and governments had warned for years about North Korean social engineering tactics targeting the crypto industry.