The Arara Data Breach Exposed 77 Million Email Addresses, Then Fueled 7 Million Phishing Messages

The Arara Data Breach in Numbers

Paycloud Holdings, a Tokyo-based company, has disclosed the Arara data breach: attackers broke into its Arara Message email distribution service and stole data including about 77 million email addresses. The victims are not just Arara's own users. Around 380 corporate clients used the breached environment, and the stolen data includes names, phone numbers, and addresses depending on which client's records were involved. No credit card numbers were taken, according to the company's disclosures.

The timeline is a case study in how breach numbers grow. Arara detected unauthorized access on October 28 and disconnected the affected server. Its first report, on October 29, estimated roughly 3.01 million email addresses involved. The second report, dated November 2, revised that to about 77 million. The count is email addresses, not individual people, and one person can appear in several clients' lists, but the scale of the revision tells its own story about how hard it is to scope a breach in the first days.

Arara suspended the Arara Message service and related services on October 31. As of the November 2 report, no restart date had been set. For 380 client companies, that means their email distribution infrastructure went dark while the investigation continued.

The Stolen Data Became a Phishing Machine

The breach did not stop at theft. According to reports on Paycloud's disclosures, the stolen contact data was used to send about 7.13 million phishing emails impersonating a credit card company. This is the part that should worry anyone whose address was in the haul. The attackers did not just get a list of emails. They got names, phone numbers, and addresses matched to real companies, which is exactly the raw material for phishing messages that look personal and plausible.

That is the pattern security teams warn about every year: a breach at a service provider becomes a phishing campaign against the provider's customers' customers. The people receiving those 7.13 million emails did not do business with Arara. They did business with one of 380 companies that did. Most of them will never hear the name Arara, which is precisely why the phishing works.

It is not yet known who carried out the attack, or exactly whose individual records were taken. That uncertainty is normal in the first week of a breach, and it is also the reason the practical advice matters more than the attribution.

What to Do If Your Email Was in the Haul

First, expect phishing that uses your real name and real details. The classic red flags still apply: unexpected messages about payments, accounts, or deliveries, links that do not match the sender's domain, and any request to enter credentials or download a file. But the Arara case shows why the old advice to look for bad spelling is outdated. When attackers have your name, your address, and the name of a company you actually use, their emails can look polished.

Second, treat any message claiming to be from a credit card company with extra suspicion right now, since that is the impersonation the attackers chose. Go to the company's site or app directly instead of clicking a link in an email. Third, if you use the same password anywhere else, change it, and turn on two-factor authentication on your email account if you have not already. Our guide on what to do after a data breach walks through the full checklist in a calm order.

For companies, the lesson is about vendors. Arara was one supplier, and its breach exposed the customers of 380 companies. Vendor security reviews and data minimization, keeping only the customer data a vendor actually needs, are the two controls that would have limited the damage here. They are boring controls. They are also the ones that matter.

A Busy Week for Japanese Breaches

Arara is not the only Japanese breach disclosed this week. SMBC Consumer Finance announced on November 5 that unauthorized access to its card loan guarantee system may have exposed data on up to 320,118 people, including driver's license numbers, employers, annual incomes, and guaranteed amounts. MUJI disclosed that up to 27.26 million app and online store records may have leaked. Japan's breach trackers now list 264 incidents for 2026, with 119 confirmed leaks.

That clustering is not a coincidence. Attackers follow the same logic investors do: they go where the data is concentrated. Email distributors, retailers, and financial services all hold large, structured customer databases, and a single intrusion can yield millions of records. The DreamHost breach showed the same pattern in hosting, and the Amadeus breach showed it in travel, where one supplier exposed a dozen airlines.

The Arara case will keep developing. The investigation continues, the service remains suspended, and the full list of affected individuals is still being established. What is already clear is the shape of the modern breach: the target is a vendor, the payload is contact data, and the second act is phishing at industrial scale. Defending against that means assuming your email address is already out there, and building habits that hold up even when the attacker knows your name.