SockAnalyst
← All playbooks
HighBreach · 2026-11-07

ARARA Message breach: 81 million email addresses taken from Japanese email-delivery service

SockAnalyst · Security+ certified analyst.

What happened

Paycloud Holdings' subsidiary ARARA, which runs the ARARA Message email-delivery service used by companies for newsletters and notifications, published its third report on November 6, 2026. A third party used credentials without authorization to access its systems between October 28 and 31, 2026 (October 27 activity looks like reconnaissance), including a shared admin environment and a separate cloud environment ('Environment B'). The latest report adds 3,249,492 addresses from Environment B, bringing the total to 81,329,467 unique email addresses taken; about 47 million of them came with attribute data. ARARA says this was not a new intrusion, that it holds no credit-card numbers, and that the count is addresses, not people. It disabled the abused credentials, has kept the whole service suspended since October 31 with no restart date, and says up to about 380 client companies are involved. Downstream firms including Zaif and Rakuten Securities have issued their own notices.

Who's affected

Companies that sent mail through ARARA Message (up to about 380 clients) and the people on their mailing lists in Japan. Recipients face a higher risk of targeted phishing impersonating those brands; client companies have lost a delivery channel until the service returns.

✅ Fix / patch

  • ARARA Message clients: check ARARA's notices and admin console for your exposure (Environment B clients are being contacted separately) and plan an alternate delivery channel while the service is down.
  • Rotate any API keys, SMTP credentials and passwords tied to ARARA and other email-delivery providers; limit who holds them and remove unused ones.
  • Notify your own customers that a supplier leak occurred, warn them about impersonation emails, and plan for the count to change as the investigation continues.
  • Recipients: treat unexpected emails asking for passwords or card details as phishing; ARARA says it will never ask for them by email.

🔎 Quick hunt check

No IOCs published. If you used ARARA Message, hunt for phishing aimed at your customer base or staff that spoofs your brand or newsletters, logins with any ARARA-linked service accounts after Oct 27, and unusual API activity against other email/marketing SaaS using shared credentials.

MITRE ATT&CK: T1078, T1530, T1567, T1566

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=email (sourcetype=*o365* OR sourcetype=*proofpoint* OR sourcetype=*mimecast*)
(subject="*パスワード*" OR subject="*password*" OR subject="*カード*" OR subject="*card*" OR subject="*アララ*" OR subject="*ARARA*")
| eval sender_domain=lower(mvindex(split(sender,"@"),1))
| lookup newsletter_brand_domains sender_domain OUTPUT is_brand
| where isnull(is_brand)
| stats count dc(recipient) as recipients values(subject) as subjects by sender_domain, src_ip
| sort - recipients
// Brand/newsletter-themed phishing from non-brand domains after the ARARA leak
EmailEvents
| where TimeGenerated > ago(30d)
| where Subject has_any ("ARARA","アララ","password","パスワード","card","カード","newsletter","メルマガ")
| where DeliveryAction == "Delivered" and (AuthenticationDetails has "fail" or ThreatTypes has "Phish")
| summarize Recipients=dcount(RecipientEmailAddress), Msgs=count(), Subjects=make_set(Subject, 10) by SenderFromDomain, SenderIPv4
| order by Recipients desc
// Delivered phishing with failed auth themed on brands/newsletters that used ARARA

See all hunt queries →

⏱ CISA deadline

Not in CISA KEV as of Nov 14, 2026.

Sources

Related playbooks

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →