INCIDENT REPORT · CP-2026-012

Arara Message Email Platform Breach (incl. City of Osaka)

L3 · ELEVATEDCONFIRMED

Attackers breached Arara Message, an email-distribution service run by Paycloud Holdings subsidiary Arara, abused it to send about 7.13 million phishing emails from Oct 28–30, 2026, and took or may have taken about 77 million email addresses plus member data held for up to about 380 client organizations (Paycloud disclosure, Nov 2). Downstream victims include the City of Osaka, which said on Nov 13 that about 1.08 million email addresses from its online administrative-services system were exposed via contractor TKC's use of Arara.

Incident ID: CP-2026-012
Incident date: 28 OCT 2026
Detection date: Not publicly documented
Affected countries: Japan
Plotted location: Tokyo, Japan (Affected service provider location (Arara / Paycloud Holdings))
Threat classification: Level 3 — ELEVATED
Classification rationale: Tens of millions of records across hundreds of organizations, including a major city government, plus mass phishing.
Attack type: Data Breach
Nature: Malicious activity
Attack vector: Unauthorized access to the Arara Message email-distribution service (reported exploitation of web-server vulnerabilities and misuse of authentication credentials)
Sectors: Technology, Government, Retail, Finance, Transportation
Critical infrastructure: No
Organizations affected: Arara Inc. (Paycloud Holdings), City of Osaka, TKC Corporation, Sega, Asoview, SMBC Consumer Finance
Operational consequences: Arara fully suspended the service on Oct 31 with no restart date; client disclosures include Sega (about 2.2 million addresses), Asoview (about 15.8 million member records) and the City of Osaka (about 1.08 million addresses, without names or My Number IDs). Paycloud says no credit card numbers were leaked; the 77 million figure is provisional and not a count of individuals.
Estimated financial impact: No reliably documented figure
Attribution (as stated): No official attribution recorded

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Arara Message Email Platform Breach (incl. City of Osaka)

L3 · ELEVATEDCONFIRMED

Incident ID

CP-2026-012

Incident date

28 OCT 2026

Detection date

Not publicly documented

Affected countries

Japan

Plotted location

Tokyo, Japan (Affected service provider location (Arara / Paycloud Holdings))

Threat classification

Level 3 — ELEVATED

Classification rationale

Tens of millions of records across hundreds of organizations, including a major city government, plus mass phishing.

Attack type

Data Breach

Nature

Malicious activity

Attack vector

Unauthorized access to the Arara Message email-distribution service (reported exploitation of web-server vulnerabilities and misuse of authentication credentials)

Sectors

Technology, Government, Retail, Finance, Transportation

Critical infrastructure

Organizations affected

Arara Inc. (Paycloud Holdings), City of Osaka, TKC Corporation, Sega, Asoview, SMBC Consumer Finance

Operational consequences

Arara fully suspended the service on Oct 31 with no restart date; client disclosures include Sega (about 2.2 million addresses), Asoview (about 15.8 million member records) and the City of Osaka (about 1.08 million addresses, without names or My Number IDs). Paycloud says no credit card numbers were leaked; the 77 million figure is provisional and not a count of individuals.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

No official attribution recorded