The Tokyo Nomad
← All articles
Follow-up / Mail delivery and supply chain

Arara Message, a week on: 81.3 million addresses, a second cloud environment and a corrected timeline

Arara's third report adds a second cloud environment, raises the total to 81,329,467 addresses and corrects when data left. What changed since our first analysis, and what clients should do now.

Published: 8 min read
Incident period: Intrusion 27–31 Oct 2026; service stopped since 31 OctSources checked: 9 Nov 2026

30-second briefing

Key facts
Arara's third report adds 3,249,492 addresses taken from a separate cloud environment with misused credentials, puts the total at 81,329,467 after duplicates, and lowers the shared-environment count to 2,842,400. Arara also corrected the exfiltration period to 28–31 October. The service stays stopped with no restart date.
Who should act
Third-party Risk · Email Security · Legal / Privacy
First action
If your organisation used Arara Message or ASP repica, check which period you reported to the PPC and correct it to 28–31 October if needed. Ask Arara whether your data was in environment B, and do not plan to resume sending through it until the way in is known.
Uncertainty to keep in mind
Arara has not said how the attacker first got in, how the environment B credentials were obtained, or when the service will restart. Per-client figures are still being sent out, and some large client notices do not name their vendor.
Header graphic: Arara Message, a week on. Four panels: 81,329,467 addresses after removing duplicates, up from about 77 million; 3,249,492 from a second cloud, environment B, entered with stolen credentials; data left continuously from 28 to 31 October, corrected on 6 November; no restart date.
THE POSTURE QUESTION

Arara's third report, of 6 November, changes the picture we gave on 3 November. Data also left a second cloud environment, taken with misused credentials, so the total is now 81,329,467 addresses after duplicates are removed. And data left client servers continuously from 28 October until the service was stopped on 31 October, not in the narrower window the second report gave. Arara asks clients who reported the old period to the PPC to correct it. The service has no restart date, and Arara still has not said how the attacker first got in.

Arara's third report changes three things we told readers on 3 November. In our analysis of Japan's mail-delivery platform breaches, we gave Arara's count as about 77 million addresses, taken through its Arara Message service. The report of 6 November adds a second cloud environment that the attacker also entered, with misused credentials. That brings the total to 81,329,467 addresses after duplicates are removed. It also corrects when the data left: continuously from 28 October until Arara stopped the service on 31 October, not in the narrower window its second report gave. And the number of organisations that have named Arara in their own notices has risen to 194. This follow-up sets out what changed, what we had wrong, and what Arara's clients should do now.

What is affected, and what is not

Status as of Arara's third report (6 November) and its service status page (9 November, 15:00). Counts are email addresses, not people, and the categories overlap.

Item Status What is known
All addresses taken, duplicates removed Affected (confirmed) 81,329,467. Adding the second report's categories without removing duplicates gave 80,386,187.
Through the service (environment A) Affected (confirmed) 78,102,937, up from about 77 million: 31,346,375 addresses alone and 46,756,562 with other details such as names or dates of birth.
The shared environment from the first report Affected (confirmed) 2,842,400, revised down from 3,386,187: 2,507,311 addresses alone and 335,089 with other details.
Environment B, a separate cloud Affected (new, confirmed) 3,249,492 addresses, and nothing else. Taken between 28 and 31 October using misused credentials. Arara invalidated them and stopped the environment on 31 October.
Recipients' inboxes Unchanged The third report makes no change to the second report's count of up to about 7.13 million phishing emails.
Card numbers Not held Arara says it holds no card numbers.
Service Stopped, no restart date Arara Message and the ASP repica services have been stopped since 14:50 on 31 October. Arara will decide on a restart after finding the way in, changing all credentials and confirming the service is safe.

What changed, and what we had wrong

A second cloud. The second report covered the service's own cloud (environment A) and its shared environment. The third report adds environment B, on a different cloud, which the attacker entered with misused credentials between 28 and 31 October. Arara says it had been investigating that environment at the time of the second report but could not yet confirm what had left it.

A higher total, and one lower count. With environment B added and duplicates removed, the total is 81,329,467, about 943,000 more than the second report's categories added together. The shared-environment count went down, from 3,386,187 to 2,842,400. The third report also says that "up to about 380 companies" already included the 61 companies in the shared environment and those in environment B.

The dates. Our original article said that data left 97 client servers between 01:36 on 29 October and 02:22 on 30 October. That is what the timeline in Arara's second report said. On 6 November Arara corrected what it had told clients individually. Data left those servers continuously from 28 October until the service was stopped on 31 October, at times that differ by server. Arara asks clients who used the earlier period in reports to the PPC, or in their own explanations, to change it. We have corrected our original article.

One clarification. The access on 27 October was reconnaissance. The unauthorised login and the first data export happened on 28 October.

Timeline from 27 October to 9 November 2026 in Japan time, as revised by Arara's third report. At 08:36 on 27 October there is access that looks like reconnaissance; the third report makes clear this was not yet the break-in. On 28 October an unauthorised login to the shared environment and a data export take place, and phishing through the service begins at 03:59. From 28 to 31 October the attacker, through one of the service's servers, copies data from 97 client servers continuously until the service is stopped, and separately 3,249,492 addresses leave environment B, a different cloud, entered with misused credentials. On 31 October Arara finds the intrusion, invalidates the credentials, stops environment B and, from 14:50, the whole service, ASP repica included. On 2 November the second report gives about 77 million addresses through the service, 3,386,187 in the shared environment and up to about 380 client companies. On 6 November the third report adds environment B, gives 81,329,467 addresses after removing duplicates and revises the shared environment to 2,842,400, and Arara corrects what it told clients: data left from 28 October until 31 October, not on 28 and 29 October. On 8 November 194 organisations and services have named Arara in their own notices, by piyolog's count. At 15:00 on 9 November Arara reports no new progress and the restart is still undecided.

Figure 1. Original graphic built from Arara's second and third reports and its service status page. Times are Japan time.

Who has named themselves since

By piyolog's count, 194 organisations and services had named Arara in their own notices by 8 November, up from 125 on 4 November. That figure includes nine local-currency services and leaves out ten intermediaries such as marketing-tool vendors.

Some of the largest new notices do not name their vendor, so they should not be added to Arara's figures without care. Plenus, which runs the Hotto Motto chain, says up to about 7 million members' records leaked from an outside contractor's newsletter service between 28 and 31 October. The records include email addresses, names, dates of birth and phone numbers. AIRDO says up to 673,920 email addresses leaked from an outside mail-delivery system. Both match Arara's dates, and piyolog lists both under Arara, but neither notice names the contractor.

The attacker's view

Step ATT&CK What Arara describes
Use credentials to enter a separate cloud T1078.004 Valid Accounts: Cloud Accounts Environment B entered with misused credentials, 28–31 October.
Move from one server to many TA0008 Lateral Movement Through one of the service's servers into many others; data taken from 97 client servers.
Keep taking data until stopped TA0010 Exfiltration Continuous from 28 October to the 31 October shutdown, by server.

The new detail matters for one reason. An attacker who reached a second, separate cloud with working credentials had access beyond the first server it broke into. Where those credentials came from is the question Arara has not yet answered.

What Arara's clients should do now

  1. Correct the period in your PPC report. If you reported 28–29 October, or the second report's narrower window, change it to 28–31 October, as Arara asks.
  2. Ask whether you were in environment B. Arara says it is contacting environment B's clients individually. If you have not heard, ask, and ask for your own count.
  3. Plan to send without Arara for now. It has no restart date, and its own conditions for restarting are to find the way in, change all credentials and confirm the service is safe. Ask to see evidence of all three before you go back.
  4. Change what you gave Arara when it reopens. Replace admin passwords and API keys, whatever Arara does on its side.
  5. If you resell or relay through Arara or repica, tell your clients. Many of the organisations naming Arara reached it through a marketing tool or system vendor, not a contract of their own.

People on the lists should treat messages about the incident with care. Arara says it will not email anyone asking for passwords or card details.

Blastmail, the other mail platform still offline, is covered in a separate follow-up on Blastmail.

What remains unknown

  • How the attacker first got in. Arara has said only "a web-server vulnerability" and "problems in the system environment".
  • Where the environment B credentials came from.
  • When the service will restart.
  • Each client's own figures. Arara is still sending them out one by one.
  • Which client notices that name no vendor are really Arara's.

Sources and updates

9 November 2026: first published, as a follow-up to our 3 November analysis, which now carries a correction to the exfiltration period. We read Arara's third report and service status page directly. Its news page for 6 November returned an error to our fetcher, so we relied on the PDF reports and the status page. Every figure was checked against piyolog or incidents.hatenablog. We will update this follow-up when Arara names the way in or sets a restart date.

All articles →日本語で読む ↗