Paycloud Holdings (TSE Growth: 4015) has sharply widened its account of the breach at Arara Message, the email delivery service run by its consolidated subsidiary Arara Inc. In a second report dated November 2, the company said email addresses taken in the latest intrusion number about 77 million, a provisional figure, up from the roughly 3.01 million addresses it reported on October 29.
What changed since the first report
The first report covered one system, a shared environment. The second adds client companies' own environments: 97 servers where email addresses and member data were confirmed taken. Arara estimates the affected client companies at up to about 380, and the count is still being checked.
The stolen data now goes beyond addresses. It includes items client companies registered in the service, such as names, gender, birth dates, phone numbers, membership numbers and addresses, which vary by client. The company says its services hold no credit card numbers.
Paycloud warns that the 77 million figure is not a count of end users, because one person may hold several addresses. It also says the number could change.
Three separate buckets, not one total
The report splits the incident into three categories. Access through the service itself ran from October 28 to 31 and is the roughly 77 million figure. The shared environment from the first report, accessed October 27 to 28, involved 61 client companies and 3,386,187 unique email addresses, now stated with more precision than the earlier 3.01 million. Five of those clients also had customer data with names and company names, up to 411,827 records.
| Category | Period | Scope | Count |
|---|---|---|---|
| Access via the service | Oct 28-31 | 97 client servers, up to about 380 companies | About 77 million email addresses |
| Shared environment (first report) | Oct 27-28 | 61 client companies | 3,386,187 email addresses |
| Phishing sends | Oct 28-30 | Two environments | Up to about 7.13 million emails |
Paycloud did not add the categories together because the same address may appear in more than one. The company also notes that "taken" includes cases of possible removal, judged from the volume of records read.
Phishing mail sent through the service
Separately, a third party used parts of the service to send up to about 7.13 million suspicious emails between October 28 and 30, across two environments. The messages imitated a credit card company, came from [email protected], and carried subject lines such as a request to confirm usage details. Arara said it blocked the first environment at 7:00 on October 28 and cut off the second on October 30, with no new sends after 13:32 that day. The report says no data beyond email addresses was confirmed lost through the sending itself.
Service halted, cause revised
Arara halted the whole service on October 31, finishing at 19:53, and gave no restart date. Resumption depends on identifying the entry route, replacing credentials across the board and confirming system safety; clients will be asked to reset admin passwords and API keys. Other Arara services are unaffected.
The company also revised its cause. The first report blamed a web server vulnerability; the second says problems in the system environment also played a part. It believes the same third party was behind the whole series, citing common attack origins, but is still investigating when and how the intrusion began.
Paycloud reported to the Personal Information Protection Commission on October 29 and planned to report the new findings on November 2. It notified police on October 29 and gave a preliminary report to JIPDEC the same day. It says the effect on its fiscal year ending August 2027 is under review, with results due in a third report.