Japan's mail-delivery platforms, breached in a row: 77 million addresses at Arara, 51 million at Cuenote, and phishing sent from the platforms themselves

Four Japanese services that send email for other companies were broken into within seventeen days, and two of them were then used to send phishing. Companies hand these platforms their customer lists so that newsletters, receipts and campaigns go out on time. Between 16 October and 2 November 2026, Yumirin Link (Cuenote FC), Rakus Lite Cloud (Blastmail), Sonicmoov (COMSBI Enterprise) and Arara (Arara Message) each reported an intrusion. Arara alone now counts about 77 million email addresses taken from up to about 380 client companies, and up to about 7.13 million lures posing as card companies sent through its service. This analysis starts with what is affected, then sets out how each operator says it was entered, the breaches at companies' own systems in the same week, and what to do if your company is a customer or your staff are recipients.

What is affected, and what is not

Status as of each operator's latest report: Arara on 2 November, Yumirin Link on 26 October, Rakus Lite Cloud on 2 November and Sonicmoov on 26 October. "Confirmed" means the operator said so in its own notice. The counts are the operators' own. They include records that may have been taken, they overlap between services and they are not numbers of people, so we do not add them up.

Area	Status	What is known
Arara Message (Arara, a PayCloud Holdings company)	Affected (confirmed)	Through the service, 97 client-company servers (up to about 380 companies): about 77 million email addresses, with names, sex, dates of birth, phone numbers, member numbers and postal addresses where clients stored them. In a shared environment, 3,386,187 addresses for 61 companies and up to 411,827 customer records for five of them. The whole service has been stopped since 31 October.
Cuenote FC (Yumirin Link)	Affected (confirmed)	49 systems leaked data; 51,628,280 records counted cumulatively, with 16 systems still being counted. The customer portal Cuenote BASE exposed 190 customer contact records. Yumirin Link reports no impact on Cuenote SR-S, SMS, Auth, Survey, Push or its safety-confirmation service.
Blastmail (Rakus Lite Cloud)	Affected (confirmed)	Every customer's company name, contact name, phone number, email, billing email and contract history; delivery lists and other sending data for 345 contracts. Stopped from 00:27 on 21 October; restart planned for about 11 November.
COMSBI Enterprise (Sonicmoov)	Affected (confirmed)	For some corporate customers: their admin users' names, emails and encrypted passwords, their LINE official account settings, and their own users' names, emails and other fields. Stopped since 23 October. Sonicmoov reports no impact on its separate COMSBI SaaS service. UCC Ueshima Coffee says 5,529 of its customers' email addresses leaked, although it stopped using the service in December 2023.
Recipients' inboxes	Abused to send phishing (confirmed)	Up to about 7.13 million lures posing as card companies sent through Arara from `news@arara.com` between 28 and 30 October; spam sent through Cuenote's domain as `SAISON <info@cuenote.jp>`.
Credit card numbers	Not held, per three operators	Arara, Rakus Lite Cloud and Sonicmoov say their services hold no card numbers. Yumirin Link's report does not mention card data.
Passwords of people on the lists	Not listed for end users	None of the four lists the passwords of the people on the mailing lists among the data taken. Sonicmoov lists the encrypted passwords of its corporate customers' admin users.

If a company tells you your address leaked through one of these services, what left is the address and the profile fields that company stored, not your password for that company. Expect mail that knows your name and uses the company's brand.

The four platforms, and how each says it was entered

Figure 1. Original graphic built from the operators' own reports. The left lane is what each operator found; the right lane is phishing sent through the platforms, and the PHP flaw disclosed in the same week.

Cuenote FC: a library flaw, then the support team's keys

Yumirin Link noticed at 06:49 on 16 October that one of its staff accounts was behaving oddly, and by 10:10 had traced the attack to a vulnerability in a software library. Its second report describes the chain. Through the flaw, the attacker obtained the credentials its support and quality-assurance staff use to reach customers' systems. It installed a malicious program that exported data from databases, used the staff credentials to try other systems, read other systems' data through the planted program, and stole session information to log in. The first report on 19 October covered five systems and about 9 million records; by 26 October it was 49 Cuenote FC systems and 51,628,280 records. On 18 October the company noted that the access came from overseas IP addresses. Its fixes show what was missing: until 18 October, some customer environments had no IP restriction on the admin screen or the API. Clients that have announced impact include JR Central and the Resona group.

Blastmail: two API servers

Rakus Lite Cloud's monitoring raised an alert at 21:52 on 20 October. Between 00:27 and 00:37 on 21 October it limited all access to its own office and stopped the admin screen and API; sending stopped at about 01:00. The attacker had broken into two of its API servers, run commands there, and connected from them to the sales-management system and the service database. How it got into the API servers is still under investigation. Every customer's billing contact details left through the sales system; for 345 contracts, delivery lists and other sending data left too. Clients that have announced impact include Yokohama City and JR Shikoku.

COMSBI Enterprise: a stolen admin login, then the servers' keys

Sonicmoov says a third party logged in to the service's management system on the morning of 23 October with credentials it had obtained illegitimately, then used a flaw in an admin-screen feature to obtain the servers' credentials. Sonicmoov detected it at 12:12, cut external access at 13:20, and says every attempt after 15:41 failed. COMSBI Enterprise is a LINE integration platform built separately for each corporate client, distinct from its COMSBI SaaS service. Sonicmoov has not named its clients; UCC Ueshima Coffee named itself on 2 November.

Arara Message: three events in four days

Arara's second report splits its case into three events.

The shared environment, 27–28 October. After access that looks like reconnaissance at 08:36 on 27 October, the attacker logged in to the environment's admin screen between 11:09 and 15:43 on 28 October and used its data-export function. Arara stopped the environment at 16:31. Its first report, on 29 October, counted about 3.01 million addresses; the second counts 3,386,187 unique addresses for 61 companies and up to 411,827 customer records for five.
Through the service, 28–31 October. From one of the service's servers the attacker reached many others and copied their databases; data left 97 client-company servers between 01:36 on 29 October and 02:22 on 30 October. Arara found this on the morning of 31 October, revoked the misused accounts and keys from 12:58, and finished stopping the whole service at 19:53.
Phishing, 28–30 October. Two environments were used to send up to about 7.13 million emails posing as card companies, from news@arara.com, with subjects such as 「利用内容確認のご依頼」 ("request to confirm usage details") and 「ご利用明細確認のご依頼」 ("request to confirm your statement"). The first went out at 03:59 on 28 October and the last at 13:32 on 30 October. Arara says the recipients were addresses the attacker brought in from outside.

Arara attributes all three to the same third party, because the attacks came from the same sources. It gives the cause as "a web-server vulnerability and problems in the system environment", and is still investigating when and how the intrusion began.

The PHP2Shell timing. On 22 October, the day after PHP disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), PayCloud Holdings listed Arara Message among its subsidiaries' services stopped as a precaution, and said Arara was carrying out emergency maintenance on some environments. Arara's breach reports do not say whether that flaw was the way in. See our PHP2Shell analysis.

What the four have in common

This is our reading of the four notices.

The target was the address books. In each case the data taken was the client companies' lists of their own customers.
Each route ran through an account or server with reach into many customers' data: support staff credentials at Cuenote, admin consoles at COMSBI and Arara's shared environment, API servers at Blastmail, and one server that could reach 97 others at Arara.
Two platforms carried the same lure. Cuenote's domain and Arara's service both sent card-company phishing with the subject 「利用内容確認のご依頼」. A shared subject line shows a shared playbook, not a shared attacker; no source links the four breaches to one group.
Data outlives the contract. UCC stopped using COMSBI in December 2023, yet 5,529 of its customers' addresses were still there to be taken.

This matches what JPCERT/CC described in its alert of 8 October on the run of breaches at Japanese organisations, updated on 23 October: attackers probe each target for many known flaws rather than one, abuse management APIs, and use API keys stolen from other breached systems. The National Cybersecurity Office has asked companies to tighten their defences, contractors included, as the Ministry of Internal Affairs and Communications relayed on 9 October. Our risk model treats a supplier like this as one shock that lands on many companies at once.

Also this week: breaches at companies' own systems

Company	Reported	Who and what	What is known about the cause
Nojima Online and its used-phone buyback site (Nojima)	2 November; detected 1 November	About 7 million members, not counting those who had left: name, date of birth, sex, postal address, phone, login ID, encrypted password and email. No card data held.	Unauthorised access to the member management system; under investigation. Both sites suspended.
@cosme (istyle)	2 November; confirmed 28 October	About 3 million @cosme common-ID members, including people who have since left: user ID, nickname, name, postal address, phone, email, sex, date of birth, skin type and hair type. No passwords or card data.	Under investigation with an outside security firm.
M.League official site and online shop	2 November; attack on the night of 29 October	9,502 people who used the shop or member site since October 2019: name, postal address, phone, email, login ID, password hash and 13,922 orders. No card data held.	Not published; the old system is being retired and rebuilt elsewhere.
JAL and Japan Transocean Air, through Amadeus	28 October, updated 30 October	About 92,000 customers: booking code, name, flight date, route and class; for about 2,000, also email, phone, passport number, nationality and mileage number.	Unauthorised access to Amadeus's passenger service system; traces from 10 August 2023 to 23 September 2026.
ANA, through Amadeus	30 October	About 37,800 customers' booking information.	The same Amadeus breach.

Two of these are supplier breaches as well: the airlines' bookings sat in Amadeus's system, as UCC's addresses sat in Sonicmoov's.

Phishing from a real sending service

Mail sent through a genuine delivery platform starts with advantages that a spoofed message lacks: a sending domain with a history, servers that mail filters see every day, and very likely valid SPF and DKIM for that domain. The operators' notices do not say how the lures fared against authentication, so treat that as our expectation, not a finding. What gives them away is the mismatch: a display name that claims to be a card company, such as SAISON, on an address at a mail-delivery company's domain. Arara says its lures went to addresses the attacker brought in, so receiving one does not by itself mean your address was in Arara's data. For how a valid signature can still carry phishing, see our analysis of DKIM replay.

Arara's and Yumirin Link's advice to recipients is the same: do not open the link, delete the mail, and if you entered card details, call the card issuer at once.

The attacker's playbook: what these cases show

Step	ATT&CK	What the operators' notices say
Exploit an internet-facing flaw	T1190 Exploit Public-Facing Application	Cuenote FC: a library vulnerability. Arara: a web-server vulnerability. Blastmail: the route into the API servers is still under investigation.
Log in with staff or customer credentials	T1078 Valid Accounts	Cuenote: support staff credentials taken and reused. COMSBI: admin-console credentials obtained illegitimately. Arara: an admin-screen login; misused accounts and keys revoked.
Reuse a stolen login session	T1539 Steal Web Session Cookie	Cuenote: session information taken and used to log in.
Plant a program on the server	T1505 Server Software Component	Cuenote: a "malicious program" that exported database data; its type is not stated.
Run commands on servers	T1059 Command and Scripting Interpreter	Blastmail: commands run on two API servers.
Take server credentials from an admin feature	T1552 Unsecured Credentials	COMSBI: a flaw in an admin-screen feature exposed the servers' credentials.
Spread from one server to many	TA0008 Lateral Movement	Arara: from one service server to 97 client servers. Cuenote: from one system to 49 and more.
Export the client address books	TA0009 Collection, TA0010 Exfiltration	All four; at Arara's shared environment, through the admin screen's own export function.
Send phishing through the platform	T1584 Compromise Infrastructure, T1566.002 Spearphishing Link	Arara: up to about 7.13 million lures from `news@arara.com`. Cuenote: lures as `SAISON <info@cuenote.jp>`.

The defender's playbook

1. If your company uses or used one of these services

Ask the operator, in writing, what of yours was taken (template below): which environment, which fields, how many records and from which period. Arara and Rakus Lite Cloud say they are contacting every customer individually.
Change every credential you gave the service: admin-screen passwords, API keys, and SMTP and webhook credentials. Arara says it will require this before it restarts. JPCERT/CC's alert describes API keys stolen in one breach being used against other systems.
Report to the Personal Information Protection Commission where the law requires it. Where both you and the operator must report, the commission's guidelines allow a joint report. Rakus Lite Cloud offers one, and says the commission has accepted reports it files on behalf of local governments.
Tell the people on your list what was taken and which lures to expect, using the note below, sent from your own domain rather than the affected service.
Plan to send without it for now. Blastmail aims to restart around 11 November; Arara has given no date.

2. If you keep customer data at any messaging vendor

Delete what you no longer send to. When a contract ends, ask for written confirmation that your lists were deleted; UCC's case shows what lingers.
Take a retired vendor out of your mail records. Remove its include: from your SPF record and its DKIM selector records, so that a breach at a vendor you no longer use cannot send mail that passes as yours. This is our recommendation; none of the notices reports mail sent in a client's own name.
Restrict and watch access. Ask whether the admin screen and API accept logins only from your addresses (Cuenote added IP restrictions only after the breach), whether the vendor's staff can reach your environment, and how fast the vendor would tell you.
Keep the minimum fields. A mailing list needs an address; dates of birth and phone numbers only add to what leaks.

3. If you are a recipient

Treat any mail asking you to confirm card usage, a statement or account details as suspect, whoever it claims to be from, and go to the card company's app or site yourself.
If you entered card details, call the number on the back of the card.
If a company tells you your address leaked through one of these services, expect mail that uses that company's name.

4. Which teams should act

Team	Action	Done when
Third-party Risk	List every email, SMS and LINE messaging vendor; send the questions below to any of the four, then to the rest	Written answers on file; old lists deleted
Email Security	Run the lure and click hunts; block `news@arara.com` and card-brand display names on delivery-platform domains	Lures removed; every click followed up
IT Operations	Rotate API keys and admin passwords; remove retired vendors from SPF and DKIM	Old keys revoked; DNS records cleaned
Legal / Privacy	Decide on reporting with the operator; approve the customer notice	Report filed or decision recorded
SIEM	Alert on admin or API logins to messaging vendors from unexpected addresses, where the vendor provides logs	Rule live, or the gap recorded

Hunting: did the lures reach your staff?

No attacker infrastructure has been published beyond the sender addresses and subjects. The two queries look for those in your mail, then for clicks on links in the matching messages.

Both queries are illustrative and were not run against live data. On 3 November 2026 (JST) both were analysed with Microsoft's Kusto language service (version 12.4.1) against the column lists on Microsoft Learn's EmailEvents and UrlClickEvents pages; a test query with a made-up column failed the same check, as it should. Both tables need Microsoft Defender for Office 365.

1. The lures in your mail. Microsoft Defender XDR advanced hunting.

// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Card-company lures sent through breached mail-delivery platforms, from 14 October 2026.
// The two senders and the three subjects are the ones Arara and Yumirin Link published; real card notices can share a subject, so check the sender.
let Since = datetime(2026-10-14);
let PlatformSenders = dynamic(["news@arara.com", "info@cuenote.jp"]);
EmailEvents
| where Timestamp >= Since and EmailDirection == "Inbound"
| where SenderFromAddress in~ (PlatformSenders)
    or Subject contains "利用内容確認のご依頼"
    or Subject contains "ご利用明細確認のご依頼"
    or Subject contains "ご利用確認のお願い"
| project Timestamp, RecipientEmailAddress, SenderDisplayName, SenderFromAddress,
    SenderMailFromDomain, Subject, AuthenticationDetails, DeliveryAction, DeliveryLocation, NetworkMessageId
| order by Timestamp desc

2. Who clicked. Join the same messages to Safe Links clicks.

// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Who clicked a link in those lures? Each row is a person to contact and, if they typed card details, a card to cancel.
// Safe Links must be on for clicks to be recorded; clicks from mail in Drafts or Sent Items cannot be joined.
let Since = datetime(2026-10-14);
let PlatformSenders = dynamic(["news@arara.com", "info@cuenote.jp"]);
let Lures = EmailEvents
    | where Timestamp >= Since and EmailDirection == "Inbound"
    | where SenderFromAddress in~ (PlatformSenders)
        or Subject contains "利用内容確認のご依頼"
        or Subject contains "ご利用明細確認のご依頼"
        or Subject contains "ご利用確認のお願い"
    | distinct NetworkMessageId, SenderFromAddress, Subject;
UrlClickEvents
| where Timestamp >= Since and Workload == "Email"
| join kind=inner Lures on NetworkMessageId
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough, SenderFromAddress, Subject
| order by Timestamp desc

Download the examples: lures KQL · clicks KQL.

Reading the results. A lure from news@arara.com or info@cuenote.jp with a card company's name is the campaign. A message with one of the subjects from a card company's own domain may be genuine; confirm with the card company rather than through the link. Anyone in the click results who went on to enter card details should call their card issuer the same day.

Copy-paste templates

Questions for a mail or messaging vendor

Subject: Breaches at mail-delivery platforms – please confirm your exposure

Four mail-delivery and messaging services in Japan reported intrusions between
16 October and 2 November 2026 (Arara Message, Cuenote FC, Blastmail, COMSBI Enterprise).
Please answer in writing by [date]:

1. Do you run, resell or depend on any of these services, or share systems with them?
2. Which of our data do you hold today (lists, fields, sending logs, staff accounts,
   API keys), and since when?
3. Who at your company or your subcontractors can reach our environment,
   and how is that access logged?
4. Do your admin screen and API accept logins only from addresses we approve,
   and is multi-factor authentication enforced?
5. If our data were taken, how soon would you tell us, and would you support
   a joint report to the Personal Information Protection Commission?
6. Please confirm that data from any contract we have ended has been deleted.

Thank you.

Note to customers whose addresses were on the list

Subject: About your email address and a security incident at our mail provider

[Service name], the service we use to send you email, has reported unauthorised access.
The data it held for us was your email address [and: name / date of birth / ...].
It did not hold your password or card number.

You may receive emails that use our name, or a card company's name, and ask you
to "confirm usage" or "check your statement". We will never ask for card numbers or
passwords by email. Do not open links in such messages; go to our site or your card
company's app yourself. If you entered card details, call your card issuer now.

Questions: [contact]

What remains unknown

How Arara and Blastmail were first entered, and when Arara's intrusion began.
Which vulnerability Arara means, and whether PHP2Shell played any part.
How many people are behind the counts once duplicates across clients and services are removed.
Which client companies are affected. The operators are telling clients one by one, and many clients have not announced.
Whether the four breaches share an attacker. Arara links its own three events; no source links the platforms.
Whether more lures have been or will be sent using the stolen lists.

Sources and updates

3 November 2026: first published, covering the operators' reports up to 2 November. We read each operator's own notice and the affected companies' own notices, except ANA's, which we read through a search extract and checked against Jiji Press. Rakus Lite Cloud's later report gives 345 contracts; CNET Japan's earlier article gives 344. Every figure was confirmed in at least two sources: the operator's notice and a news report that quotes it. PayCloud Holdings' site returned an error page from outside Japan; we read it through a connection in Japan. We will update this analysis when Arara and Rakus Lite Cloud publish their next reports.

30-second briefing