Osegi
Security·2 min read

Arara Breach: Moss Burger, Workman, IIJmio Confirm Data Leaks

A breach at Japanese email delivery provider Arara is hitting its client companies one after another, with Moss Burger, Workman and IIJmio confirming leaks.

Illustration of an email envelope with a broken padlock symbolizing a customer data leak from an email delivery service.
Image: ITmedia NEWS
SUMODialoediviewergiftdetect

Companies that use Japanese email delivery service Arara are announcing customer data leaks one after another following unauthorized access to the provider. On November 4, Moss Food Services, which runs Moss Burger, along with Workman, Internet Initiative Japan (IIJ) and Sumitomo Realty & Development, all disclosed incidents. Arara estimates that up to about 380 client companies are affected.

Millions of addresses exposed

At Moss Food Services, 7,517,087 records from its "Moss WEB Member" service leaked, including email addresses, age, gender and prefecture of residence. No payment data such as credit card information was included. The company said Arara, the provider of the "repica" email system, reported the issue on November 4.

Workman said up to about 1.45 million newsletter addresses from its online store were exposed. IIJ disclosed 983,458 addresses of IIJmio budget SIM subscribers, and Duskin reported 657,886 records from its "DDuet" member site. Sumitomo Realty said 205,208 addresses of customers who inquired about housing units leaked through a contractor's use of Arara's service.

Earlier announcements include Camel Coffee, which operates KALDI Coffee Farm (820,420 addresses), and Seijo Ishii (up to 168,630). Several leaks exceeded one million: TKC at up to 2,230,812, Chobirich at 1,348,525, and Asoview at 15,821,184. Three companies including Bic Camera said about 14.9 million records may have been exposed.

Earlier all-clear notices reversed

Some firms first said they were unaffected. Shochiku Multiplex Theatres said on October 29 and 30 that its "SMT Members" data was safe, but on November 2 Arara reported a newly found intrusion into another environment that covered it, involving 3,320,305 members. Yokohama Rubber was told on November 3 of a leak of company names and addresses of news release subscribers. Subway moved from saying customers were excluded to saying it could not rule out inclusion, and has asked Arara to reinvestigate.

Arara's own estimates have widened. Its October 29 first report cited about 3.01 million addresses from a shared server environment. On November 2 it said attackers used the service to enter 97 servers for client companies, and that about 77 million addresses may have leaked. The attacker also sent up to about 7.13 million suspicious emails posing as a credit card company.

Arara has fully suspended its service since October 31, with no restart date set.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:araradata breachemail deliveryrepicajapanmoss burger

More from this day

See all →

More in: Security

See all →