Skip to content
TALAYINSIGHT
RegionAsia-Pacific

MediumII Cyber Warfare & Critical Infrastructure4 November 2026, Wednesday

Breach at a single email provider spreads to 380 Japanese companies

PayCloud Holdings, parent of the Japanese email marketing service Arara, said on 2 November that around 77 million email addresses may have leaked, with up to 380 client companies affected. By 4 November at least 15 companies had announced their own loss figures.

Location: TOKYO

According to the second report cited by ITmedia on 4 November, an attacker entered Arara's shared server environment between 28 and 31 October and took data from 97 servers belonging to client companies. In its 2 November report the company blamed web server vulnerabilities and problems in the system environment, without giving technical detail. The fields leaked vary by company, and some of the 97 servers also held names, dates of birth, phone numbers and addresses. Up to about 7.13 million fake emails posing as a card company were sent from the same system on 28–30 October. The service has been completely shut since 31 October with no reopening date.

The address count, 3,386,187 in the first report on 29 October, grew as contracted companies disclosed their own figures. According to ITmedia's 5 November round-up, the Bic Camera group reported about 14.9 million records, Asoview 15,821,184, Mos Food Services 7,517,087, TKC up to 2,230,812 and IIJ 983,458. Arara says the 77 million figure may overlap with company disclosures, so the totals cannot be added up and the number of unique individuals could not be verified. Shochiku and Yokohama Rubber initially said they were unaffected, then corrected their statements on 2–3 November.

The constraint lies not in the separate defences of 380 companies but in the single email infrastructure they share; that is why one vulnerability reached 97 servers. On the insurance side, policies are written company by company, while the loss stems from a single event on 28–31 October. According to Innovatopia's 22 October review, whether a breach at a supplier is covered is worded differently even between 2 major insurers. Personal Information Protection Commission data show that personal data on 260 million people had leaked or was at risk of leaking in Japan between 1 April and 16 October.

Talay assessment

Bottom line

The Arara incident shows Japan's breach wave moving down from individual companies to shared service providers. With 77 million addresses and 380 companies, it proves that one supplier vulnerability can expose not a sector but an economy at once. The most likely path is that company disclosures keep growing for a few more weeks and the government adds supplier audits to its emergency package.

Likely effects

  • Japanese consumer companiesNegativeWeeks

    At least 15 companies that have disclosed losses each bear the cost of customer notification and possible apology payments; the loss stems from one event, but the bill is fragmented.

  • Cyber insuranceNegative1–6 months

    A single supplier breach triggers several policies at once; insurers may revisit their accumulation and supplier cover terms.

  • Phishing riskNegativeWeeks

    The 77 million leaked addresses and 7.13 million fake emails lay the ground for a new wave of fraud posing as card companies and banks.

Possibilities, ranked

  1. 1
    Disclosures grow, regulation follows55%

    More companies disclose losses, and the government ties supplier audits to the cyber package.

    Watch: The Personal Information Protection Commission's November breach count and supplier guidance

  2. 2
    Incident closes, costs stay scattered30%

    Arara reopens its service, and companies absorb the costs on their own balance sheets.

    Watch: Arara's announcement of a service restart

  3. 3
    A second round of fraud15%

    Large-scale phishing using the leaked addresses turns into card and bank losses.

    Watch: Phishing loss disclosures by card companies and the police

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Market reaction

Indicators affected

  • Addresses at risk▼ ~77m
  • Companies affected▼ ≤380
  • Fake emails▼ ≤7.13m

Sources

  1. ITmedia NEWS — Arara Message second report: 77 million records and 380 companies
  2. ITmedia NEWS — Mos, Workman and IIJmio also disclose Arara-related leaks
  3. ITmedia NEWS — About 14.9 million records at risk in the Bic Camera group
  4. Nippon.com (Jiji) — Personal data of 260 million compromised since April
  5. Innovatopia — What cyber insurance pays and what it does not (22 October 2026)
Share