A breach at one email vendor exposed up to 77 million addresses, and millions of phishing emails have already gone out

Japanese email service provider Arara served hundreds of companies, including SEGA. After the breach, up to 7 million emails impersonating a credit card company were sent. This is the scenario in which your data leaks from a company you have never heard of

Techwire staff · Edited by: Eyal Abuksis-Levi · November 10, 2026 · 3 min read

Japanese company Paycloud Holdings, owner of email service provider Arara, said up to about 77 million email addresses were taken in a breach of Arara's systems. Arara provides companies with a service for sending newsletters and marketing messages, and the breach affected up to 380 of its business customers. For some customers, names, phone numbers and home addresses also leaked. According to the company, the service did not hold credit card numbers.

The numbers have risen sharply since the first report in late October, which spoke of about 3.4 million addresses at 61 customers. The company stresses that 77 million is the number of addresses, not people, and may include duplicates across different customers' lists. Arara shut down its entire service on October 31 and has not said when it will resume. According to the company, the breach came through a web server vulnerability and problems in system configuration.

The damage is no longer theoretical. Paycloud confirmed that after the unauthorized access, up to about 7.13 million suspicious emails impersonating a credit card company were sent. Among the companies that notified customers of the leak is SEGA, which reported that 2.2 million email addresses of its newsletter subscribers were exposed, without names, passwords or card details.

What makes this affair important is its structure. SEGA's customers do not know Arara, never gave it their address and did not know it existed. But when you sign up for a newsletter, the address almost always passes to an outside email vendor, and that vendor serves hundreds of other companies. One breach there is worth hundreds of separate breaches, and a real email address tied to a well-known brand is excellent raw material for convincing phishing.

What to do? Anyone who received notice of such a leak does not need to change their password because of it, since passwords were not exposed. But be suspicious of any email arriving 'from the company' asking you to click a link, verify card details or pay. The safe way is to go to the website or app directly, not through the link in the email.

Keep reading

Cyber & Security

A critical Xen Orchestra flaw is being exploited: attackers are taking over virtualization servers

An authentication bypass in the tool for managing XCP-ng servers lets an attacker gain admin rights without a password. For organizations that moved from VMware to cheaper alternatives, it is a reminder the alternative needs protection too

Techwire staff / 3 min read

Cyber & Security

A forgotten cloud vendor became a back door: an attacker abused Qubole's access to customers' AWS accounts

Researchers at Wiz and Israeli company Sentra exposed an attack in which an attacker used a data platform's permissions to get into dozens of companies' cloud environments and steal secrets and data. Many customers had probably forgotten that access existed

Techwire staff / 3 min read

Cyber & Security

Explainer: What is a 'cross-account role' in the cloud, and why it has become attackers' favorite door

Almost every organization in the cloud gives outside vendors access to its account, usually through a mechanism called a cross-account role. The Qubole attack shows what happens when the vendor is breached, or when everyone forgets the access is still there

Techwire staff / 3 min read