Paycloud Holdings reported on 2 November 2026 that unauthorised access to Arara Message had taken, or may have taken, about 77 million email addresses from 97 servers set aside for individual client companies. Arara Message, a service that sends business email to customers, is run by Arara Inc., a subsidiary of Paycloud Holdings. The 2 November report was the second on the incident, and it widened the scope first disclosed on 29 October 2026 well beyond the original estimate. Among the Japanese email delivery service breaches disclosed in October 2026, the new total is the largest reported. Paycloud describes the total as preliminary, and it is not a count of distinct people.
Sequence of events
Two distinct scopes make up the incident. One is an environment shared by client companies. The other is a set of servers dedicated to individual clients. Within days of the first disclosure, the dedicated server scope had grown far larger than the shared scope.
Arara found the unauthorised access in the shared environment on 28 October 2026. The figure given for that environment in the first report, dated 29 October 2026, was about 3.01 million email addresses. By the second report, published on 2 November 2026, the shared scope had been restated as 61 companies with 3,386,187 unique email addresses, after duplicate addresses were removed. The restatement comes from the category table in the BigGo Finance account of the second Paycloud report. For five of the 61 companies, the second report also confirmed that up to 411,827 items of customer data, including names and company names, had been extracted.
The dedicated servers were reached separately, between 28 and 31 October 2026, and that access came to light on 31 October 2026. The dedicated scope reaches up to about 380 client companies, and it accounts for the headline total of about 77 million email addresses. Jiji Press, through Nippon.com, gave the same total and the same upper company estimate on 2 November 2026. Kyodo News reported the same day that the total should not be read as a number of affected people, since one person can hold several email addresses.
Each of the three totals belongs to a different scope, and they cannot be added together. The 3.01 million total was the opening estimate for the shared environment, and the revised 3,386,187 total replaces it for that same environment. The 77 million total belongs only to the dedicated server scope. Paycloud has not totalled the counts, because one address can occur in more than one category.
Categories of exposed information
The dedicated server records pair email addresses with other fields, and the fields present differ from one client company to another. The BigGo Finance account lists names, gender, dates of birth, phone numbers, membership numbers, and addresses. A message that names its recipient and gives a date of birth or a phone number therefore matches details the recipient supplied to a client company.
Email addresses form the bulk of the dedicated server data. Around them, the fields present differ from one client company to another, and the BigGo Finance account lists names, gender, dates of birth, phone numbers, membership numbers, and addresses. Kyodo News likewise reports names, gender, and dates of birth among the customer details registered by client companies. Paycloud states that credit card numbers do not appear in the affected data, a point both the Jiji and Kyodo reports repeat.
Within the shared scope, the confirmed extraction at five companies, up to 411,827 items of customer data including names and company names, stands apart from the 3,386,187 unique addresses in that same scope. For the dedicated scope, Paycloud words the 77 million total as addresses taken or possibly taken. That wording leaves room for data that was exposed without being removed.
Phishing emails sent through the service
The attackers used the service itself to send up to about 7.13 million messages that impersonated credit card companies, from two environments, between 28 and 30 October 2026. The sending address was news@arara.com, and the subject lines asked recipients to confirm usage details or to confirm statement charges, according to the BigGo Finance account. The destination addresses came from outside, supplied by the attacker, rather than taken from client lists for this operation.
Arara shut off outside access to one environment at 7:00 a.m. on 28 October 2026, and blocked communications on the second environment at 1:26 p.m. on 30 October 2026. The same account records no further sends confirmed after 1:32 p.m. on 30 October. Jiji Press, through Nippon.com put the total at up to about 7.13 million suspicious messages impersonating a credit card company, and Kyodo News reported that the messaging service had been misused to send approximately 7.13 million messages posing as credit card company mail to outside addresses.
So far, this phishing run is the only confirmed misuse connected with the incident. Published reports describe no confirmed misuse of the leaked addresses beyond it. The run also shows a gap in the standard advice to verify sender authentication. Mail that travels through a hijacked legitimate environment carries genuine signatures, because it moves over the real servers with the real keys. Japan Cyber Watch observes that a DMARC pass proves only that mail genuinely came from the domain it names, not that the sender is honest. A check of SPF, DKIM, and DMARC, on its own, would therefore pass this mail.
Pattern in Japanese email delivery services
Arara is the fifth. Four Japanese email delivery services were breached earlier in October 2026: Arcadia, Yumil Link (Cuenote), Blastmail, and Y-mail, according to Japan Cyber Watch. Yumil Link alone accounts for a cumulative 51.63 million records across 49 client systems, a total that the Arara figure has now passed, and three of the four earlier services were likewise abused to send phishing from the vendor's own systems or under customer names, according to the same analysis.
Japan Cyber Watch argues that the shared weakness in these cases sits on the vendor side of the boundary. In its assessment, intruders reached the privileged access the vendor uses to configure and support each customer's environment, instead of breaking in through one customer's weak password, and it names secret keys, support staff credentials, setup scripts, and API servers as that common weak point. That assessment covers the four earlier services; for Arara, Japan Cyber Watch describes the case only as closer to the pattern. Arara's own confirmed cause remains a flaw in a web server plus faults in the surrounding system environment, and the entry route is still under investigation, so any privileged-path link for Arara itself is unconfirmed.
Company response and service suspension
Arara Message has been out of service since 31 October 2026, with no restart date announced. Kyodo News notes that the service has been suspended since Saturday, meaning 31 October, and that the company will weigh system security and other factors before deciding on resumption.
Arara withdrew the credentials that had been misused and blocked communications on the affected environments, according to the BigGo Finance account. The company sent a preliminary report to Japan's Personal Information Protection Commission and alerted police on 29 October 2026, and it sent a preliminary report to the Japan Institute for Promotion of Digital Economy and Community, with further reports due on 2 November 2026.
Restarting the service depends on tracing the intrusion route, replacing credentials in full, and verifying that the systems are safe. On resumption, Arara intends to ask client companies to reset admin panel passwords, API keys, and other credentials. The effect on figures and earnings is still being assessed and is due to appear in a third report. Paycloud advises caution over emails, phone calls, and other approaches claiming to come from Arara or its client companies.
Steps described for affected customers
For a customer of a company that used Arara Message, the first question is whether a particular address sits in the exposed data. Published breach guidance presents a check of whether an address was leaked as the opening step, since it settles whether the address is already in circulation before anything else is done. Where one password served several services, the same guidance presents changing that password and assigning each service a password of its own, because a leaked address helps an attacker most when it pairs with a reused credential.
The phishing danger here takes a defined form. Card company impersonations, with subjects about confirming usage details or statement charges, have already gone out through the service. Guidance on how phishing uses a leaked email explains how an address combined with personal details lets a sender shape a message around the recipient's genuine relationship with a company. Paycloud's warning fits that shape, pointing to care over unexpected messages that request account confirmation.
A longer term question is which address goes on the next signup form. One address spread across every service leaves its owner unable to identify the source when phishing mail starts arriving on it. Giving a different email address for every website reverses that position: mail landing on the address reserved for a single service identifies that service as the source, and that address can be closed without disturbing any other service.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Investigation and open questions
Several central questions stay open while the investigation continues. Outside specialists are assisting with the inquiry into the entry route, and neither the technical detail of the web server flaw nor the detail of the system environment faults has been published. Until those details appear, published reports do not establish whether the intrusion route has been closed outright or only interrupted by the suspension.
The numbers stay open as well. The 77 million total is preliminary, has not been de-duplicated, covers data that may have been taken off premises, and remains under scrutiny. No final de-duplicated total for the dedicated server scope has been released, and the third Paycloud report is expected to address figures and earnings impact. No list of affected client companies has appeared in the sources available at the time of writing, no restart date for Arara Message has been set, and no misuse of the leaked addresses beyond the phishing run described above has been confirmed.
Top comments (0)