Japan’s ARARA lost 81.3 million email addresses from up to 380 clients

01Three million on day one, 81 million eight days later

ARARA’s first notice, on 29 October, said one system had been entered through a web-server vulnerability and that about 3.01 million email addresses held by the companies using it had been taken. ARARA is a consolidated subsidiary of PayCloud Holdings, listed on the Tokyo Stock Exchange’s Growth market.¹ Four days later the second report added client environments on 97 servers. An intruder had got into one of the service’s own servers and moved from there into many others between 28 and 31 October, copying database contents. That added about 77 million addresses and up to about 380 client firms.²

On 6 November the third report found a second cloud environment, B, from which 3,249,492 addresses had been taken over the same four days with misused credentials, and gave the total after removing duplicates.³ The count grew because the investigation widened, not because the attacks went on: ARARA says environment B “is not the result of a new unauthorised access”. It also cut the shared environment’s figure from 3,386,187 to 2,842,400, and its counts include addresses that “may have been taken”, judged from the volume of records read.²³ The service has been stopped since 31 October, with no restart date, and PayCloud says the effect on its results for the year to August 2027 is still under review.⁴⁵

02How one mailer reaches hundreds of companies

An email-delivery service holds three things for each client: the list, the fields the client chose to upload with it, and a record of every send. ARARA lists what was taken through its service as the addresses, the items each client registered (“name, gender, date of birth, phone number, member number, address and so on, which differ by client”) and “records such as delivery destinations”. It holds no card numbers.² The clients’ notices show how far back those records go. SMBC’s loss covers recipients of mail sent from 1 July to 31 October; Studio Atao’s covers addresses on its send lists for up to the past 120 days; SEGA lists eleven newsletters from 2 July to 28 October.⁶¹⁵¹⁸

In ARARA’s account the service was reached three ways: an unauthorised login to the shared environment’s admin screen on 28 October, using its data-export function; a jump from one of the service’s servers into many others; and credentials used without permission on environment B. It gives the cause as a web-server vulnerability together with “problems in the system environment”; when and how the intruder first got in is still under investigation.²³

The client list is wider than ARARA’s own contracts. Ryobi Bus names the service it used as repica, whose provider is ARARA. GMO Payment Service says its contractor, the law firm Martial Arts, sent mail through ARARA Message.¹⁶¹⁷ A ministry was a direct client: the English newsletter of the Ministry of Internal Affairs and Communications lost 775 addresses and 21 names.¹⁹ By the count of the Japanese security blog piyolog, 232 organisations and services had named ARARA in their own notices by 10 November.²⁴

Sanrio and GMO Payment Service both say their own systems were not affected; the data left from the fourth company in the chain.¹⁶ The same pattern ran through the earlier pieces on one booking system that exposed ten airlines and on a vendor’s credentials that opened its clients’ AWS accounts.

03What the clients were told, and when

Clients learned their share in steps, and several were first told they were clear. SMBC says ARARA told it on 28 October that its logs showed no leak, and on 2 November that 227,216 of its addresses had left.¹⁵ Workman was told on 29 October that its members were not included, and by phone on 2 November that up to about 1.45 million addresses were.⁹ SEGA asked ARARA on 29 October and was told no leak had been found; an email on 3 November said otherwise, and a formal report followed between 5 and 8 November.⁶ Shogakukan was told on 2 November that its environment was included, and says it saw no technical evidence until 5 November.⁸

The counts in the clients’ own notices run from 775 addresses at the ministry to 15,821,184 at Asoview, a leisure-booking site, whose records include names, phone numbers, postcodes and ticket purchases. The chart shows the ten largest counts we read, each from the client’s own notice.^7191114

ARARA reported to the Personal Information Protection Commission on 29 October and 2 November, with a further report planned for 6 November; to the Kanto telecoms bureau of the same ministry on 4 November; and to the police on 29 October.³ SEGA says ARARA proposed a joint report to the commission in both companies’ names.⁶

04Addresses are not people

ARARA says it plainly: “the count is the number of email addresses, not the number of people”. One person can hold several addresses.²³ The clients’ counts mix units further. Ryobi Bus counts 43,221 cumulatively, so an address mailed twice can count twice; Chobirich says its 1,348,525 is addresses, not members; Shogakukan says its 1,993,665 may include provisional registrants and people who are no longer members.⁸¹⁰¹⁷

For a person, what matters is what came with the address. Of the 81,329,467, ARARA counts 47,044,380 with member details and 34,285,087 as addresses alone, and says the split is still being checked. Nearly all the detailed records came through the route into client environments.³

The reports also reconcile. Added as if nothing overlapped, the second report’s categories make 80,386,187; the third report’s total is 943,280 higher. In between, the client-server count was refined from about 77 million to 78,102,937, environment B added 3,249,492, the shared environment fell by 543,787, and 2,865,362 duplicates between routes came out.²³

05Nitori: a separate breach, counted in records

Nitori Holdings, the furniture and homewares retailer, disclosed its own breach on 9 November. It found unauthorised access to “a system we manage” on Friday 6 November, cut it off, and found in its logs that a third party may have had access from mid-to-late October. Up to 37.62 million records may have left: individual members and buyers (member number, name, email, address, phone, date of birth, gender), corporate members (company and contact details), and orders placed through Nitori’s official shops on online marketplaces. Login passwords and card data are not among them.²⁰

Nitori’s unit is 件, items or records, and its notice says the combination of data differs from customer to customer, so a person who is a member, a buyer and a marketplace customer can sit in more than one set. It says the scope and the count may change as log analysis continues, that it is reporting to and consulting the commission and the police, and that it will contact affected customers by email or post. Its notice names no supplier and is not part of ARARA’s count.²⁰

Three things to watch: a restart date for ARARA Message and the final count behind it, PayCloud’s statement on what the incident costs, and whether Nitori’s 37.62 million moves as its log analysis ends.