Short answer
Arara, a Japanese email delivery provider, said on 29 October 2026 that about 3.01 million email addresses had leaked from a shared server, then said on 2 November that up to about 77 million might be affected. According to ITmedia, client companies including Asoview, Bic Camera and Mos Burger have since reported leaks.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Arara Inc. (Arara Message email delivery service) |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Confirmed by the organization |
| Sector | Email delivery service provider |
| Country | Japan |
| Disclosed | 2026-10-29 |
| People or records affected | Up to about 77 million email addresses across up to about 380 client companies, as estimated by Arara |
What data was exposed
- Email addresses of newsletter subscribers and members at client companies
- For Asoview, 15,821,184 records with name, member ID, gender, registration and last login dates, postal code, region and ticket purchase details
- For Mos Burger, 7,517,087 records with email address, age, gender and prefecture
- Names and addresses in some cases, according to Arara
What happened
Arara is a Japanese provider of bulk email delivery. Companies hand it their subscriber lists so it can send newsletters and notices. On 29 October 2026 Arara reported that about 3.01 million email addresses had leaked from a shared server environment, according to ITmedia.
On 2 November it widened the picture. ITmedia reports that Arara said an attacker used the service to get into 97 servers belonging to contracted companies. It said up to about 77 million email addresses might have leaked, and up to about 380 client companies could be affected. Arara described that as a possible figure, not a confirmed total. It also said up to about 7.13 million phishing emails posing as credit card companies were sent from its system between 28 and 30 October. Arara has suspended the service since 31 October with no restart date.
Companies that have reported
The largest single report so far is from the leisure booking site Asoview, which said on 3 November that 15,821,184 member records were affected. ITmedia says the data covers members who received mail through Arara and includes email address, name, member ID, gender, registration and last login dates, postal code and region, plus ticket purchase details and facility names. Asoview said passwords and card information were not given to Arara. It stopped delivery through the service on 2 November and invalidated the admin passwords and API keys.
Bic Camera, Kojima and Sofmap reported a possible leak of about 14.9 million newsletter addresses between them. On 4 November Mos Food Services (Mos Burger) reported 7,517,087 records with email address, age, gender and prefecture, Workman up to about 1.45 million, IIJ 983,458 for IIJmio customers, Duskin 657,886 and Sumitomo Realty 205,208, per ITmedia. Others reported earlier in the week.
What is still open
Several firms first said they were unaffected and later revised that. Subway reported on 29 October that no customer data was involved, then on 2 November said it could not rule that out. Because the 77 million figure is an upper estimate, the number of people actually affected is not yet known. We found no public claim by the attacker, and the entry method has not been described in the sources we read.
The risk here is mostly phishing. A message that uses your real name and a real ticket purchase can still be fake. See our guide to phishing messages and the data breach checklist. Related Japanese incidents are on the breaches index, including skyticket.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails impersonating credit card companies, which Arara said were sent in volume from its system.
- Fake notices pretending to be from Arara or from a retailer you subscribe to, asking you to confirm an address or login.
- Targeted emails that mention facilities or tickets you really bought, built from the booking data in the Asoview records.
- Spam and fake prize emails sent to addresses that are now in criminal hands.
What to do if you are affected
- 01Treat any email that mentions Arara, a data leak or a refund as suspect, and open the company's site or app yourself instead of using links.
- 02Do not enter card details after clicking a link in an email, even if your name and a real order or ticket detail are correct.
- 03Watch card statements for unfamiliar charges, and report them to the card issuer.
- 04Change passwords only through the official site, and use a unique password on every service.
Frequently asked questions
What is Arara and why does it matter to me?
Arara runs an email delivery service that companies use to send newsletters and notices. If you subscribed to a client company, your address may have passed through Arara even though you never dealt with it directly.
How big is the leak?
Arara first reported about 3.01 million addresses on 29 October. On 2 November it said up to about 77 million might have leaked, a possibility rather than a confirmed total, with up to about 380 client companies affected, per ITmedia.
Were passwords or credit cards leaked?
According to ITmedia, Asoview said passwords and card information were not entrusted to Arara. Mos Food Services and Bic Camera also said payment data was not included. Check each company's own notice.
Which companies have reported leaks?
ITmedia lists Asoview, Bic Camera, Kojima, Sofmap, Mos Food Services, Workman, IIJ (IIJmio), Duskin, Sumitomo Realty, Shochiku Multiplex Theaters, Seijo Ishii and others. Subway said it could not rule out customer data.
Sources
- BIC CAMERA etc.: possible leak of about 14.9 million records via contractor Arara, ITmedia NEWS, 2026-11-04
- アソビュー 1582万件の会員情報が流出 (Asoview: 15.82 million member records leaked), ITmedia NEWS, 2026-11-04
- モスバーガー、ワークマン、IIJmioなど相次ぎ公表 (Mos Burger, Workman, IIJmio and others announce leaks one after another), ITmedia NEWS, 2026-11-05
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.