---
title: "Japan’s ARARA lost 81.3 million email addresses from up to 380 clients"
summary: "What ARARA, its clients and Nitori disclosed from 29 October to 9 November: how one mailing service exposed up to 380 firms’ lists, and why 81.3 million addresses are not 81.3 million people."
url: https://www.thetechbag.com/blog/arara-81-million-email-addresses-380-clients-japan
format: Analysis
desk: "Security"
area: "Email & phishing"
region: Global
published: 2026-11-11
facts_checked: 2026-11-11
author: TechBag (The TechBag Journal)
tags: ["ARARA data breach","Japan data breach","email addresses leaked","Arara Message breach","ARARA","ARARA Message","PayCloud Holdings","email delivery service","newsletters","data breach","third-party risk","supply chain","phishing","SEGA","Asoview","Shogakukan","SMBC","GMO Payment Service","Nitori","Japan","Personal Information Protection Commission","DPDP","data processor","CERT-In"]
cover: https://www.thetechbag.com/blog/covers/arara-81-million-email-addresses-380-clients-japan.png
---

# Japan’s ARARA lost 81.3 million email addresses from up to 380 clients

*What ARARA, its clients and Nitori disclosed from 29 October to 9 November: how one mailing service exposed up to 380 firms’ lists, and why 81.3 million addresses are not 81.3 million people.*

Analysis · Security · Email & phishing · By TechBag · Published 2026-11-11 · Facts checked 2026-11-11 · Canonical: https://www.thetechbag.com/blog/arara-81-million-email-addresses-380-clients-japan

The short version

1. ARARA, a Tokyo email-delivery company, says 81,329,467 email addresses were taken from its ARARA Message service between 28 and 31 October, from up to about 380 client companies. 47,044,380 of them came with member details such as names and dates of birth. Its first estimate, on 29 October, was about 3.01 million.[1][3]
2. One intrusion reached hundreds of companies because they all mailed through the same service, some at one or two removes: Sanrio’s shoppers reached it through a payment provider and a law firm. SMBC, Workman and SEGA were each first told no leak of their data had been found.[6][9][15][16]
3. The count is of addresses, not people, as ARARA itself says. In a separate breach, Nitori says up to 37.62 million records may have left a system it manages; it found the intrusion on 6 November.[3][20]

Most companies that send newsletters do not run their own mail servers. They upload a list to a delivery service and press send. We read ARARA’s three reports and the notices of the clients that have named it, in Japanese, to answer four questions: how one supplier’s breach reached hundreds of companies, how the count grew from 3 million to 81 million in eight days, why that number is not a number of people, and what a company that mails through such a service can check. A separate breach at Nitori, disclosed the same week, carries the same counting problem.

## Three million on day one, 81 million eight days later

81,329,467

email addresses taken from ARARA Message, duplicates removed

ARARA’s third report, 6 November. The first estimate, on 29 October, was about 3.01 million.

ARARA’s first notice, on 29 October, said one system had been entered through a web-server vulnerability and that about 3.01 million email addresses held by the companies using it had been taken. ARARA is a consolidated subsidiary of PayCloud Holdings, listed on the Tokyo Stock Exchange’s Growth market.[1] Four days later the second report added client environments on 97 servers. An intruder had got into one of the service’s own servers and moved from there into many others between 28 and 31 October, copying database contents. That added about 77 million addresses and up to about 380 client firms.[2]

On 6 November the third report found a second cloud environment, B, from which 3,249,492 addresses had been taken over the same four days with misused credentials, and gave the total after removing duplicates.[3] The count grew because the investigation widened, not because the attacks went on: ARARA says environment B “is not the result of a new unauthorised access”. It also cut the shared environment’s figure from 3,386,187 to 2,842,400, and its counts include addresses that “may have been taken”, judged from the volume of records read.[2][3] The service has been stopped since 31 October, with no restart date, and PayCloud says the effect on its results for the year to August 2027 is still under review.[4][5]

**Figure: ARARA's count rose 27-fold in eight days as each report found more**

*Email addresses ARARA reported taken, and the steps between, 28 October to 9 November 2026 (Japan time)*

| Date | Event | Detail |
| --- | --- | --- |
| 28 Oct 2026 | Intrusion; fake card mails sent | Admin-screen login and export on the shared environment, 11:09 to 15:43; shut at 16:31. Phishing from news@arara.com from about 03:59. |
| 29 Oct 2026 | First report: about 3.01m | One system, a web-server vulnerability. |
| 31 Oct 2026 | Whole service stopped | Theft through the service itself found that morning; all delivery halted by 19:53. |
| 2 Nov 2026 | Second report: about 77m more | Client environments on 97 servers; up to about 380 firms; up to about 7.13m phishing mails. |
| 6 Nov 2026 | Third report: 81,329,467 | Environment B adds 3,249,492; duplicates between routes removed. |
| 9 Nov 2026 | SEGA: 2,196,044 of them | One client's share, from eleven newsletters sent 2 July to 28 October. |

Source: PayCloud Holdings and ARARA, first, second and third reports; SEGA · as of 11 November 2026

Reported7.13 million fake card-company emails, from ARARA's own address

From 28 to 30 October the intruder also used the service to send up to about 7.13 million emails posing as credit-card companies, from news@arara.com, with subjects such as “Request to confirm your statement”. They went to addresses the intruder brought from outside, not to the stolen lists. ARARA cut off the first environment at 07:00 on 28 October, then found a second one still sending and blocked it at 13:26 on 30 October.[2]

## How one mailer reaches hundreds of companies

An email-delivery service holds three things for each client: the list, the fields the client chose to upload with it, and a record of every send. ARARA lists what was taken through its service as the addresses, the items each client registered (“name, gender, date of birth, phone number, member number, address and so on, which differ by client”) and “records such as delivery destinations”. It holds no card numbers.[2] The clients’ notices show how far back those records go. SMBC’s loss covers recipients of mail sent from 1 July to 31 October; Studio Atao’s covers addresses on its send lists for up to the past 120 days; SEGA lists eleven newsletters from 2 July to 28 October.[6][15][18]

In ARARA’s account the service was reached three ways: an unauthorised login to the shared environment’s admin screen on 28 October, using its data-export function; a jump from one of the service’s servers into many others; and credentials used without permission on environment B. It gives the cause as a web-server vulnerability together with “problems in the system environment”; when and how the intruder first got in is still under investigation.[2][3]

The client list is wider than ARARA’s own contracts. Ryobi Bus names the service it used as repica, whose provider is ARARA. GMO Payment Service says its contractor, the law firm Martial Arts, sent mail through ARARA Message.[16][17] A ministry was a direct client: the English newsletter of the Ministry of Internal Affairs and Communications lost 775 addresses and 21 names.[19] By the count of the Japanese security blog piyolog, 232 organisations and services had named ARARA in their own notices by 10 November.[24]

**Figure: A Sanrio shopper's address sat at ARARA three companies down the chain**

*How customer data from one online shop reached ARARA Message, and what was taken, mail sent 20 July to 30 October 2026*

1. 01The shopA Sanrio Online Shop customer pays later with GMO deferred payment, run by GMO Payment Service.
2. 02The payment providerGMO Payment Service’s contractor, the law firm Martial Arts, emails customers about their bills.
3. 03The mailerMartial Arts sends that mail through ARARA Message, where the list and send records sit.
4. 04The theftUp to 106,997 addresses taken, 5,771 with name, amount and items billed; 196 were Sanrio shoppers.

Source: GMO Payment Service, 5 November; Sanrio Online Shop notice; ARARA second report · as of 11 November 2026

Sanrio and GMO Payment Service both say their own systems were not affected; the data left from the fourth company in the chain.[16] The same pattern ran through the earlier pieces on [one booking system that exposed ten airlines](https://www.thetechbag.com/blog/amadeus-breach-airlines-one-supplier) and on [a vendor’s credentials that opened its clients’ AWS accounts](https://www.thetechbag.com/blog/qubole-credentials-aws-accounts-trust-roles).

## What the clients were told, and when

Clients learned their share in steps, and several were first told they were clear. SMBC says ARARA told it on 28 October that its logs showed no leak, and on 2 November that 227,216 of its addresses had left.[15] Workman was told on 29 October that its members were not included, and by phone on 2 November that up to about 1.45 million addresses were.[9] SEGA asked ARARA on 29 October and was told no leak had been found; an email on 3 November said otherwise, and a formal report followed between 5 and 8 November.[6] Shogakukan was told on 2 November that its environment was included, and says it saw no technical evidence until 5 November.[8]

The counts in the clients’ own notices run from 775 addresses at the ministry to 15,821,184 at Asoview, a leisure-booking site, whose records include names, phone numbers, postcodes and ticket purchases. The chart shows the ten largest counts we read, each from the client’s own notice.[7][19][11][14]

**Figure: One client, Asoview, accounts for 15.8 million of the 81.3 million addresses**

*Email addresses each client says were taken from ARARA Message, millions, the ten largest counts we read, published 3 to 9 November 2026*

Asoview

15.82 m

SEGA

2.2 m

Shogakukan

1.99 m

Workman

up to

1.45 m

Chobirich

1.35 m

St.Cousair

0.88 m

Matsui Securities

up to

0.83 m

Belc

0.79 m

Kinko's Japan

0.27 m

SMBC

0.23 m

|  | Value (m) |
| --- | --- |
| Asoview | 15.82 |
| SEGA | 2.2 |
| Shogakukan | 1.99 |
| Workman | 1.45 |
| Chobirich | 1.35 |
| St.Cousair | 0.88 |
| Matsui Securities | 0.83 |
| Belc | 0.79 |
| Kinko's Japan | 0.27 |
| SMBC | 0.23 |

Source: Each company's own notice (sources 6 to 15) · as of 11 November 2026 · Workman and Matsui Securities give an upper limit; counts are per client and can overlap

TechBag countTen clients, 25.8 million addresses

The ten counts in the chart add up to 25,798,111, about 32% of ARARA’s total; Asoview alone is about 19%. The sum is ours, and it overstates: ARARA removed duplicates across its whole count, so an address on two clients’ lists is one address in its total and two in this sum.[3]

ARARA reported to the Personal Information Protection Commission on 29 October and 2 November, with a further report planned for 6 November; to the Kanto telecoms bureau of the same ministry on 4 November; and to the police on 29 October.[3] SEGA says ARARA proposed a joint report to the commission in both companies’ names.[6]

Our viewWhat a company that mails through a service can check

Who sends mail for you, and through whom: Sanrio’s exposure came through its payment provider’s law firm. What goes up with the list: Matsui Securities says it never gave ARARA login IDs, PINs or account details, so none left, and Belc says it never registered postal addresses, phone numbers or birth dates.[12][13] How long send records are kept: four months of SMBC’s recipients were there. Which keys to rotate: ARARA will ask every client to reset admin passwords and API keys before it restarts.[2] And treat an early “no leak” as a status, not a finding, as SMBC, Workman and SEGA learned.

## Addresses are not people

ARARA says it plainly: “the count is the number of email addresses, not the number of people”. One person can hold several addresses.[2][3] The clients’ counts mix units further. Ryobi Bus counts 43,221 cumulatively, so an address mailed twice can count twice; Chobirich says its 1,348,525 is addresses, not members; Shogakukan says its 1,993,665 may include provisional registrants and people who are no longer members.[8][10][17]

For a person, what matters is what came with the address. Of the 81,329,467, ARARA counts 47,044,380 with member details and 34,285,087 as addresses alone, and says the split is still being checked. Nearly all the detailed records came through the route into client environments.[3]

**Figure: 58% of the stolen addresses came with member details, almost all through the client servers**

*Email addresses taken from ARARA Message by route, with and without member details, millions, as reported 6 November 2026*

Through the service, client servers

31.35

46.76

78.11 m

Shared environment

2.85 m

Environment B

3.25 m

Total, duplicates removed

34.29

47.04

81.33 m

|  | Address only | Address with member details |
| --- | --- | --- |
| Through the service, client servers | 31.35 | 46.76 |
| Shared environment | 2.51 | 0.34 |
| Environment B | 3.25 | 0 |
| Total, duplicates removed | 34.29 | 47.04 |

Source: ARARA third report, table 1 · as of 6 November 2026 · Duplicates removed within each route; the total also removes 2,865,362 duplicates between routes

The reports also reconcile. Added as if nothing overlapped, the second report’s categories make 80,386,187; the third report’s total is 943,280 higher. In between, the client-server count was refined from about 77 million to 78,102,937, environment B added 3,249,492, the shared environment fell by 543,787, and 2,865,362 duplicates between routes came out.[2][3]

## Nitori: a separate breach, counted in records

Nitori Holdings, the furniture and homewares retailer, disclosed its own breach on 9 November. It found unauthorised access to “a system we manage” on Friday 6 November, cut it off, and found in its logs that a third party may have had access from mid-to-late October. Up to 37.62 million records may have left: individual members and buyers (member number, name, email, address, phone, date of birth, gender), corporate members (company and contact details), and orders placed through Nitori’s official shops on online marketplaces. Login passwords and card data are not among them.[20]

**Figure: Nitori: up to 37.62 million records, found on 6 November, no passwords or cards**

*What Nitori Holdings disclosed about unauthorised access to a system it manages, as of 9 November 2026*

37.62m

Records that may have left (件), at most

Nitori

Mid-Oct

Earliest possible access, found in logs after the discovery

Nitori

6 Nov

Intrusion found and cut off

Nitori

None

Login passwords or card data in the set

Nitori

Source: Nitori Holdings notice, 9 November · as of 9 November 2026 · 件 counts records, not people; Nitori says the count may change

Nitori’s unit is 件, items or records, and its notice says the combination of data differs from customer to customer, so a person who is a member, a buyer and a marketplace customer can sit in more than one set. It says the scope and the count may change as log analysis continues, that it is reporting to and consulting the commission and the police, and that it will contact affected customers by email or post. Its notice names no supplier and is not part of ARARA’s count.[20]

Three things to watch: a restart date for ARARA Message and the final count behind it, PayCloud’s statement on what the incident costs, and whether Nitori’s 37.62 million moves as its log analysis ends.

In India, the company that collected the address answers for its mailer

None of the notices we read names an Indian company or Indian users; the clients that have spoken are Japanese firms and public bodies. The case still maps onto Indian law. The Digital Personal Data Protection Act, 2023 makes a company responsible for processing done “on its behalf by a Data Processor”, and its own illustration is a telecom company whose processor emails customers’ bills (section 8(1) and the illustration to section 6(6)). The company must protect data held by its processor, tell the Data Protection Board and each affected person of a breach, and cause its processor to erase data once the purpose is served (sections 8(5), 8(6) and 8(7)(b)).[21]

The breach-reporting rule under the DPDP Rules, 2025 (Rule 7) applies from 13 May 2027.[22] Today, CERT-In’s Directions of 28 April 2022 already require a body corporate to report a data breach or data leak within six hours of noticing it.[23] Section 8(7)(b) bears on the retention question above: SMBC’s loss covered four months of recipients. The [email security guide](https://www.thetechbag.com/browse/security/email-security) compares the filters that catch the phishing that follows a theft like this, and [third-party management tools](https://www.thetechbag.com/onetrust/onetrust-third-party-management) keep the register of which supplier holds which list.

How we did this

Figures as of 11 November 2026, 8pm IST

Every figure is from the company that published it: ARARA’s three reports and PayCloud Holdings’ exchange copies, each client’s own notice, and Nitori’s notice, all read in Japanese; quotations are our translations. Dates and times are Japan time. The chart shows the ten largest client counts among the notices we opened; Bic Camera’s notice could not be opened and is left out. Where a client gives an upper limit (Workman, Matsui Securities), the chart shows it. The “about 77 million” still quoted elsewhere is the 2 November estimate, replaced on 6 November. Our arithmetic, labelled where it appears: the 27-fold rise (81,329,467 against about 3.01 million), the ten-client sum and its 32% share, Asoview’s 19%, the 58% with member details, and the reconciliation of the second and third reports. The 232-organisation tally is piyolog’s, not ARARA’s. No attribution of the intrusion has been published, and none is made here.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [PayCloud Holdings: unauthorised access to ARARA Message, information leak and service stop (first report, TDnet; Japanese)](https://www.release.tdnet.info/inbs/140120261029558961.pdf) — 29 October 2026
2. [ARARA: unauthorised access to ARARA Message, information leak and service stop, second report (Japanese)](https://www.arara.com/dcms_media/other/arara_20261102__.pdf) — 2 November 2026
3. [ARARA: unauthorised access to ARARA Message, information leak and service stop, third report (Japanese)](https://www.arara.com/dcms_media/other/arara_20261106_.pdf) — 6 November 2026
4. [PayCloud Holdings and ARARA: apology and next steps on the ARARA Message intrusion (Japanese)](https://www.arara.com/news/info/20261106_arara) — 6 November 2026
5. [PayCloud Holdings: third report, TDnet copy, effect on the year to August 2027 (Japanese)](https://contents.xj-storage.jp/xcontents/AS71226/0d5f3847/6172/4bcc/bfab/73896dab795d/20261106211906670s.pdf) — 6 November 2026
6. [SEGA: personal data leak through unauthorised access at a contractor (Japanese)](https://www.sega.co.jp/release/261109_1.html) — 9 November 2026
7. [Asoview: unauthorised access to a contracted email-delivery service (Japanese)](https://www.asoview.co.jp/news/articles/AyTdT_tX) — 3 November 2026, updated 6 November
8. [Shogakukan: possible leak of personal data through unauthorised access at ARARA (Japanese)](https://www.shogakukan.co.jp/news/477708) — 6 November 2026
9. [Workman: leak of Workman Online Store newsletter addresses through ARARA (Japanese)](https://www.workman.co.jp/wp-content/uploads/2026/11/1104.pdf) — 4 November 2026
10. [Chobirich: unauthorised access to a contracted email-delivery service (Japanese)](https://chobirich.co.jp/1sgvii4gv9/) — 4 November 2026
11. [St.Cousair: leak of customer data through unauthorised access to an email-delivery service (Japanese)](https://www.stcousair.co.jp/company/news/36892) — 3 November 2026
12. [Matsui Securities: leak of customer email addresses through unauthorised access at a contractor (Japanese)](https://www.matsui.co.jp/company/press/pdf/pr261105.pdf) — 5 November 2026
13. [Belc: results of the investigation into the email-delivery service intrusion (Japanese)](https://www.belc.jp/news/20261029) — 29 October 2026, updated 3 November
14. [Kinko's Japan: customer data leak through ARARA Message, second report (Japanese)](https://www.kinkos.co.jp/corporate/archives/news/20261109/) — 9 November 2026
15. [Sumitomo Mitsui Banking Corporation: leak through unauthorised access at an email-delivery contractor (Japanese)](https://www.smbc.co.jp/news/pdf/j20261105_02.pdf) — 5 November 2026
16. [GMO Payment Service: personal data leak from the intrusion at ARARA (Japanese); Sanrio Online Shop notice on the same chain](https://www.gmo-ps.com/news/20261105/) — 5 November 2026 Sanrio: https://shop.sanrio.co.jp/news/86 (undated)
17. [Ryobi Bus: unauthorised access at the newsletter delivery provider (Japanese)](https://www.ryobi-holdings.jp/bus/news-kousoku/20261102/) — 2 November 2026
18. [Studio Atao: unauthorised access at the newsletter delivery provider, ARARA (Japanese)](https://www.studioatao.jp/news/%E3%83%A1%E3%83%BC%E3%83%AB%E3%83%9E%E3%82%AC%E3%82%B8%E3%83%B3%E9%85%8D%E4%BF%A1%E3%82%B5%E3%83%BC%E3%83%93%E3%82%B9%E6%8F%90%E4%BE%9B%E5%85%83%EF%BC%88%E3%82%A2%E3%83%A9%E3%83%A9%E6%A0%AA%E5%BC%8F/) — 6 November 2026
19. [Ministry of Internal Affairs and Communications: leak at the contractor for the English newsletter (Japanese)](https://www.soumu.go.jp/menu_news/s-news/01tsushin06_02000364.html) — 4 November 2026
20. [Nitori Holdings: possible leak of personal data through unauthorised access to our system (Japanese)](https://www.nitorihd.co.jp/news/items/2b702dbe4d438f7fef74945d68e5bd27_3.pdf) — 9 November 2026
21. [Digital Personal Data Protection Act, 2023, section 6(6) illustration and sections 8(1), 8(5), 8(6), 8(7)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) — 11 August 2023
22. [MeitY, Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (notified 13 November 2025; Rule 7 from 13 May 2027)](https://www.meity.gov.in/data-protection-framework) — 13 November 2025
23. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting; Annexure I items xi and xii, Data Breach and Data Leak)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022
24. [piyolog: a summary of the unauthorised access to ARARA Message (Japanese; tally as of 10 November)](https://piyolog.hatenadiary.jp/entry/2026/11/05/015717) — 5 November 2026, updated to 10 November

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [Japan’s PM asks for attack reports the same day; ¥10bn set aside](https://www.thetechbag.com/blog/japan-cyber-package-same-day-reports) — Japan’s government the same week: the Prime Minister asked for cyberattack reports the same day and set about ¥10bn aside.

Go deeper on TechBag

- [Email security guide](https://www.thetechbag.com/browse/security/email-security) — the filters that catch phishing sent to a stolen list
- [OneTrust Third-Party Management](https://www.thetechbag.com/onetrust/onetrust-third-party-management) — a register of which supplier holds which customer list
- [Data security posture management guide](https://www.thetechbag.com/browse/data-security-privacy/dspm) — tools that find where copies of personal data sit, including at suppliers