Arara Message Breach Reaches 77 Million Email Addresses Across Up to 380 Client Firms — Platform Abused to Send 7.13 Million Card Phishing Emails, SEGA Confirms 2.19 Million
Japanese bulk-mail provider Arara Message says a late-October intrusion exposed about 77 million email addresses from up to 380 client companies, including SEGA, MOS Burger and Zaif, and its platform sent millions of card-company phishing emails.
Overview
Japanese email-delivery platform Arara Message, run by a subsidiary of Paycloud Holdings, has confirmed that an intrusion in late October 2026 exposed about 77 million email addresses belonging to the customers of up to roughly 380 client companies. After the break-in, the attackers used Arara's sending infrastructure to push up to about 7.13 million phishing emails impersonating a credit card company. Client companies are now issuing their own notices. SEGA says 2,196,044 newsletter addresses were taken, and other named clients include MOS Burger (about 7.5 million addresses) and the crypto exchange Zaif (380,536 addresses).
The Breach
Arara Message is a bulk-mail service that Japanese brands use to send newsletters and marketing campaigns, so its databases hold subscriber lists for hundreds of companies. Paycloud's first estimate on 29 October was about 3.01 million addresses. On 2 November it raised the figure to about 77 million after finding unauthorised access to more servers. The company stresses that the number counts addresses, not unique people, so many individuals appear more than once.
What is known about the data:
- Email addresses are the core of the leak.
- The company says credit card numbers were not included. Japanese broadcast reporting says names and dates of birth may be included in some cases, depending on what each client stored, and the full set of data types is still unclear.
- SEGA says about 92,000 of its records also carried newsletter-delivery details that it is still reviewing. It says passwords and payment data were not involved.
The intrusion method has not been disclosed and is still under investigation. The service has been suspended since 31 October, with no date set for it to resume.
Timeline
- Late October 2026: Unauthorised access to Arara Message. The platform's sender address is abused to send up to about 7.13 million card-company phishing emails.
- 29 October: First disclosure, about 3.01 million addresses.
- 31 October: Arara Message fully suspended.
- 2 November: Estimate raised to about 77 million addresses and up to about 380 client companies.
- 9 November: SEGA confirms 2.19 million newsletter addresses affected. Other clients continue to notify customers.
Tradecraft
The most dangerous part of this incident is the abuse of a trusted sending platform. Phishing sent from a legitimate bulk-mail provider can pass SPF and DKIM for the provider, carries the reputation of a real sender, and reaches recipients who already expect marketing mail from that system. The stolen lists also map addresses to the brands each person subscribes to. That lets attackers write highly believable follow-up lures, such as a "SEGA account notice" or a "MOS Burger points expiry".
Indicators of Compromise
No technical indicators have been published. Expect phishing that:
- Impersonates Japanese credit card companies, game publishers, restaurant loyalty programmes or crypto exchanges
- Arrives from, or references, Arara Message or its client brands
- Urges card verification, account "re-activation" or a points claim
Defang and report any such links (for example hxxps://card-verify[.]example) to your security team.
Detection
- Mail teams: search gateway logs for messages from Arara Message sending infrastructure since late October, and quarantine card-company-themed messages from it.
- Look for spikes in user-reported phishing that mentions any affected brand.
- Crypto exchanges and payment firms: watch for credential-stuffing and account-takeover attempts against accounts whose email addresses appear in the leaked set.
Recommended Actions
For organisations that used Arara Message:
- Confirm with Paycloud exactly which lists and fields were exposed, and notify affected subscribers.
- Stop routing mail through the platform until it is restored and verified. Review SPF and DKIM records that authorise it, and remove its authorisation if you are migrating.
- Publish clear guidance telling customers what you will and won't ask for by email.
For individuals:
- Treat unexpected emails about card verification, account suspension or points as suspicious, even if they come from a brand you subscribe to.
- Go to services directly instead of clicking links. Enable MFA, especially on crypto-exchange and payment accounts.
- Expect follow-up phone calls that claim to be from Arara Message or its client companies. Paycloud has warned about these.
Analyst Assessment
By address count, this is one of the largest data exposures in Japan this year. Its real impact comes from the combination of a huge, brand-linked subscriber list and the confirmed ability to send mail from a trusted platform. Email addresses alone are low-sensitivity, but mapping each address to a specific retailer, game publisher or exchange gives attackers ready-made pretexts, and the exposure of crypto-exchange customers raises the stakes for account takeover. With the intrusion method still undisclosed, other Japanese marketing-mail providers should review their own exposure. Severity is rated High.
