Sumitomo Mitsui Banking Corp. said on the 5th that 227,216 customer email addresses had leaked, after unauthorized access to Arara, the operator of the email distribution service Arara Message. The bank uses the service to send emails to corporate clients and sole proprietors, and the addresses were exposed in the breach at Arara, which reported it to the bank on the 2nd.
The leaked data covers the recipients of emails sent between July and October this year. The bank said account numbers, deposit balances, PINs, and online banking IDs and passwords were not included.
The bank is warning customers that the stolen addresses could be used to send suspicious emails.
A vendor customers never see
The leak did not originate inside the bank. It came through Arara, an outside contractor that handles bulk email delivery, which means customer contact details held by a third party were exposed even though the bank's own systems were not reported as compromised.
Other companies that use Arara's mailing service have also reported leaks, including the travel booking site Asoview and the electronics retailer Bic Camera.