Key facts
- Paycloud Holdings disclosed in a November 2 report that attackers took up to about 77 million email addresses from Arara Message, affecting as many as roughly 380 business customers.
- Paycloud called the 77 million figure preliminary, saying it counts email addresses rather than people, is not deduplicated, and may include unconfirmed data.
- Between October 28 and October 30, attackers abused Arara Message to distribute as many as roughly 7.13 million fake emails posing as credit card company messages.
- Subject lines on the fake messages urged recipients to check card usage or billing statements.
Paycloud Holdings said in a Nov. 2 report that attackers took addresses from Arara Message. The report puts the number at up to about 77 million e-mail addresses covering as many as roughly 380 business customers.
Paycloud called the 77 million figure preliminary, explaining that it counts e-mail addresses rather than people, is not deduplicated, and may include unconfirmed data. The estimate expanded from an initial description of roughly 3.01 million addresses to about 77 million four days later. The company described the smaller figure before issuing the larger estimate. Paycloud released both figures as part of its breach disclosure.
Paycloud’s report said attackers sent fake e-mails through Arara Message between Oct. 28 and Oct. 30. They sent as many as roughly 7.13 million fake e-mails posing as credit card company messages. The subject lines were about card usage or billing statements, including one asking for confirmation of usage details. The fake e-mails were sent through the legitimate Arara Message platform while it remained online, and no suspicious e-mails were sent after Oct. 30.
Arara stopped the entire Arara Message platform on Oct. 31, and no resumption date is scheduled. The company does not store credit card numbers, and no payment card information was part of the incident. The shutdown halted all messaging through the service, and Arara has not announced when the platform might return. The outage affects all users of Arara Message.
The exposed addresses included customers of Hokuriku Electric Power and Osaka Gas. Because the list showed which company each customer belonged to, attackers could craft more convincing fake e-mails purporting to be from that company.
Japan’s National Police Agency recorded approximately 730,000 phishing reports from January to June 2026, down nearly 40 percent from roughly 1.2 million reports in the same period of the prior year. The agency said fewer reports do not mean fewer attacks. More than 70 percent of fake e-mails in July used their own domains rather than spoofed senders, and most passed impersonation checks, according to the Anti-Phishing Japan Council.
On Nov. 2, Nojima reported a breach of about 7 million members on its online shopping sites and related services, exposing login IDs and encrypted passwords. Marui Group disclosed a breach affecting up to 9,086 people. Both disclosures arrived on Nov. 2, the same day Paycloud released its Arara Message report.
Arara advised recipients to avoid links in suspicious e-mails that claim to come from Arara or client companies, and to delete such messages without typing IDs or card numbers. Individual communications from each company will show whether a recipient’s address appears on the exposed list.
Paycloud intends to notify affected parties and reveal any financial consequences in a third report. The report is expected to cover the effect on each contracted company and the effect on business performance.
Another report said the incident affected about 100,000 people. The sources disagree on the size of that incident.
The breach does not mean funds will move directly, but users should enable two-step login on financial apps and review credit card statements monthly. If credit card data theft or actual money theft is reported, attention will move from rising spam to account protection, the reporting said.
The Financial Services Agency recorded about 9,000 unauthorized transactions from January through September 2025. The transactions included stocks sold without permission valued at roughly 367 billion yen. The agency documented unauthorized activity in securities accounts during that period.
The Japan Securities Dealers Association said 58 companies decided to make multifactor authentication mandatory for logins by April 2025. Securities account hijackings in spring 2025 began with fake e-mails that lured people to fake websites where they entered IDs and passwords.
Nojima members who reuse passwords elsewhere should change them. The best defense is to develop the habit of not logging in from e-mails, the article’s author said. Password reuse across services can expose accounts to hijacking.
Join the discussion