About 77 million email addresses have leaked or may have leaked from Arara Message, an email delivery service run by Arara Inc. of Minato Ward, Tokyo, parent company Paycloud Holdings said on November 2. Up to about 380 client companies are affected, and the service has been fully suspended since October 31 with no date set for resuming it.
The figure is a follow-up to a breach Paycloud disclosed on October 29, when it reported that about 3.01 million email addresses had leaked through unauthorized access to a shared system environment. Later investigation found the damage had spread to other servers.
Attackers moved from shared systems into client servers
Between October 28 and 31, attackers passed through Arara Message's servers and entered the systems of client companies, taking email addresses and member information from 97 servers, Paycloud said. The member data includes names, gender, dates of birth, phone numbers, membership numbers and addresses, though which fields were held varies by client company.
The company is still checking the count and said it may change. Because one person can hold several email addresses, the figure does not represent the number of people affected.
Paycloud also raised the tally from the October 29 disclosure to 3,386,187 email addresses, up from about 3.01 million. Customer data including names and company names registered by five client companies may also have leaked, in up to 411,827 cases. The company said it has not added the two figures together because they may overlap.
Web server vulnerabilities and problems in the system environment were involved in the breaches. Arara invalidated the credentials that were misused, cut off server communications and halted the service entirely. It plans to identify how the attackers got in and confirm the systems are safe before deciding whether to restart. Other Arara services are unaffected, the company said.
Service used to send phishing emails
Attackers also abused the service to send up to about 7.13 million suspicious emails between October 28 and 30, posing as credit card companies. The messages came from the address [email protected] under subject lines including requests to confirm account usage and billing statements. Paycloud urged recipients not to open URLs in the emails.
Asoview, which runs the leisure and experience booking service Asoview!, said on November 3 that 15,821,184 pieces of member information had leaked in the same breach. The data includes email addresses, names and phone numbers as well as ticket purchase times and the names of facilities used. Passwords and credit card information were not affected.