Companies that use Arara's email delivery service have reported customer data leaks one after another following unauthorized access to the provider. On November 4, Mos Food Service, which operates Mos Burger, reported a leak along with Workman, Internet Initiative Japan (IIJ) and Sumitomo Realty & Development. Arara estimates that as many as about 380 client companies are affected.
751万件 at Mos, up to 1.45 million at Workman
Mos Food Service said 7,517,087 records were exposed from its Mos WEB members service, including email addresses, ages, genders and prefectures of residence. No payment information such as credit card details was included. The company said Arara, which provides the repica email delivery system, reported the leak to it on November 4.
Workman said Arara told it that up to about 1.45 million email addresses of members of its online store's email newsletter had been exposed. IIJ reported 983,458 email addresses of IIJmio — its low-cost SIM service — subscribers, and Duskin reported 657,886 records from its DDuet members site. Sumitomo Realty & Development said 205,208 email addresses of customers who had inquired about its built-for-sale housing leaked through unauthorized access to an Arara service used by a contractor.
Disclosures had already been coming for days. On November 3, Camel Coffee, which operates Kaldi Coffee Farm, said the email addresses of 820,420 members of its online store's email newsletter had leaked. Seongseong Stone Well said the same day that it had received a report from Arara and that up to 168,630 members of its Seijo Ishii.com online shop's email newsletter were affected. On November 2, Ticket Plus said in a joint statement with a group company that some users' email addresses had leaked, with the number still under investigation.
Asoview and Bic Camera group among leaks over 10 million
Several other leaks of more than 1 million records have been reported. TKC, which provides systems for accounting firms and local governments, reported up to 2,238,012 records exposed, and point site operator Chobirich reported 1,348,525. Bic Camera and two other companies said about 14.9 million records may have leaked, and Asoview disclosed the exposure of 15,821,184 pieces of member information.
Some companies first told customers they were unaffected, then reported a leak later. Shoichiku Multiplex Theaters told customers on October 29 and 30 that information from its SMT Members service had not leaked. It then learned that Arara had found new unauthorized access to a separate environment and was told on November 2 that its own environment was included. It announced the same day that members' email addresses had leaked, affecting 3,323,055 records of members registered with SMT Members.
Yokohama Rubber had also initially been told by Arara that no leak related to the company had been confirmed. On November 3 it received word that data had leaked, and announced the same day that the company names and email addresses of people registered for its news release distribution service had been exposed. Subway said in its first notice on October 29 that customer information was not affected, but in a second notice on November 2 it said it could not rule out that it was. Subway has asked Arara to investigate again and said it will publish detailed findings as soon as they are known.
Arara widens scope of confirmed breach
Arara's own statements have widened the scope of the breach it has confirmed. In its first report on October 29, it said about 3.01 million email addresses had leaked from a shared server environment. In a second report on November 2, it said the attacker had used the service to break into 97 servers belonging to client companies, and that about 77 million email addresses may have leaked.
The attacker abused Arara's service to send up to about 7.13 million suspicious emails posing as a credit card company. Arara has suspended its service entirely since October 31, with no date set for resuming it.