ARARA Message Breach: 81.3 Million Unique Emails on a Japanese Mailer

Fri Nov 06

November 6, 2026: ARARA Message, the email-delivery platform run by Paycloud Holdings, published a third report: 81,329,467 unique email addresses sat on the system, across about 380 client companies. About 7.13 million phishing messages were sent from [email protected] between October 28 and 30. The catalog entry records the unique-email census, not a count of people.

What is known

Unauthorised access hit the ARARA Message SaaS. The company stopped the service on October 31, 2026.
The 81.3 million figure is unique email addresses, not unique people. The same person can appear more than once across clients.
For some client firms, the platform also held name, sex, date of birth, phone, member number and address. Cards were not stored.
Japanese press named Arara as the mailer behind same-week airline notices from AIRDO (up to 673,920 emails) and Solaseed Air (about 490,000). Those airline rows are catalogued separately so the platform total is not double-counted.

What is not known

How many of the 81.3 million addresses belong to living people versus role accounts, test inboxes or duplicates across brands.
Which of the ~380 clients had extra identity fields on the platform, and how many people those fields cover.
The intrusion path, and whether any copy of the file has been sold.

Treat 81.3 million as a unique-email ceiling on one vendor platform. Do not add it to the airline counts.

Who is at risk

Anyone who received operational or marketing mail through ARARA Message — airline passengers, shoppers, association members. The phishing wave from the real [email protected] address is the immediate harm: a message that looks like a legitimate vendor notice can still be hostile.

What to do

Treat mail from [email protected], and lookalike domains, as untrusted. Do not click through to "confirm your booking" or "restore mail service."
If you flew AIRDO or Solaseed Air this year, use the airline site or app for boarding passes — not a link in a delayed reservation mail.
Watch for password-reset and invoice phishing that quotes a real booking or membership number.
If a client company writes to you, follow that letter, not a copy that arrives first from a free mailbox.
You cannot "remove" an email from a stolen marketing file. Ignore anyone selling that service.

Sources

Sourcing note: 81,329,467 is ARARA's unique-email count. Airline figures come from the carriers. We will update this post if Paycloud publishes a people census or a client list.