2026 ARARA Message — 81,329,467 unique emails; ~380 client firms; phishing from [email protected]
Data compromised
81,329,467 unique email addresses (not unique people). About 380 client companies. For some clients, name, sex, date of birth, phone, member number and address were also on the platform. About 7.13 million phishing mails sent from [email protected] between 28 and 30 October. Cards not stored. Downstream airlines (AIRDO, Solaseed Air) disclosed email-only leaks the same week and named Arara in Japanese press.
Technical writeup
Paycloud Holdings / ARARA third report 6 Nov 2026. Unique-email census 81,329,467. Catalogued separately from client airline rows so the platform total is not double-counted as people.
Root cause
Unauthorised access to ARARA Message, the email-delivery SaaS. Service stopped 31 October 2026. How access was obtained is unpublished. Third report 6 November 2026.