.jpg?w=1024)
A cyberattack on a Japanese email delivery service may have exposed approximately 77 million email addresses, while attackers allegedly used the compromised platform to distribute millions of suspicious messages.
Paycloud Holdings, the parent company of Arara, disclosed the incident on Nov. 2, saying unauthorized access to infrastructure supporting its Arara Message service potentially affected 97 servers and approximately 380 client companies.
The attackers also reportedly sent as many as 7.13 million suspicious emails between Oct. 28 and 30, impersonating credit card companies and attempting to deceive recipients.
Paycloud stressed that the 77 million figure represents email addresses, not individual users. Some people may have multiple addresses, and the company is still investigating how much information was actually removed.
The incident also extends beyond the latest disclosure. A previously reported breach involving a shared environment affected 61 companies and exposed 3,386,187 email addresses. Five companies also had up to 411,827 customer records containing additional personal information extracted.
Attackers also used the service to send phishing emails
The attackers did not limit their activity to stealing information. They also exploited Arara Message to distribute as many as 7.13 million suspicious emails between Oct. 28 and 30.
The messages impersonated credit card companies and came from the sender address news@arara.com. Their subject lines included requests asking recipients to confirm account usage and billing statements.
Arara blocked communications from the affected environments, invalidated compromised credentials and confirmed that no new suspicious emails had been sent after Oct. 30.
The company shut down the entire Arara Message service on Oct. 31. It has not announced a reopening date.
Shared email infrastructure creates a wider security problem
The incident highlights the risks in how businesses approach third-party email services. Companies may manage their own customer databases and security controls, but they often depend on external platforms to communicate with customers at scale.
That dependency creates a concentration risk. A successful intrusion into one service provider can expose information belonging to hundreds of otherwise unrelated businesses.
For organizations, the consequences could extend beyond notification requirements. Stolen email addresses combined with names, phone numbers and membership details give attackers more material for convincing phishing campaigns.
Arara also revised its explanation of the incident, saying the intrusion involved problems in its system environment alongside a web server vulnerability. This suggests that fixing a single vulnerable component may not be sufficient to restore confidence in the platform.
For businesses using shared communication platforms, the incident underscores the importance of understanding how vendors protect customer information, manage access, and respond when their systems are compromised.
What affected users should watch for
People who receive marketing emails, membership updates or other communications through companies using Arara Message should be alert to unexpected messages and phone calls. The confirmed phishing campaign makes this particularly important. Attackers could exploit familiarity with legitimate businesses to make fraudulent requests appear genuine.
Users should avoid clicking unexpected payment or account-verification links, sharing passwords or disclosing personal information over unsolicited calls. They should instead contact companies through independently verified websites or customer support channels.
Businesses using Arara Message also face immediate work. They need to determine whether their customer records were affected, assess potential exposure and warn customers where necessary. Arara plans to require client companies to reset administrative passwords, API keys and other credentials before service resumes.
The company has notified Japanese authorities, including the Personal Information Protection Commission, and reported the incident to police. Its financial impact remains under review.
For businesses relying on third-party communication platforms, the Arara breach demonstrates how a security failure at one provider can expose customer information, disrupt essential services, and create phishing risks across hundreds of organizations.
In other cybersecurity news, Google disrupted the XCPE botnet, which compromised more than 1.3 million Android devices, after alleging that manufacturer Videostrong Technology embedded a firmware-level backdoor that allowed criminals to hijack devices for residential proxy services, advertising fraud, and malware distribution.