Arara Message Breach Exposes About 77 Million Email Addresses

Names, birth dates and phone numbers affected

Some client companies' data goes beyond email addresses. Arara says email addresses plus attribute data covering 3,386,187 records from 61 client companies were taken. The attributes differ by company and include names, gender, dates of birth, phone numbers, membership numbers and addresses.

Suspicious mail sent through the service

The service was also misused to send suspicious emails. Between October 28 and 30, up to roughly 7.13 million messages were sent from two environments and email addresses. The sender address was news@arara.com, and subject lines included phrases such as a request to confirm usage details and a request to confirm a billing statement. The recipients were not Arara Message users but addresses that the attackers brought in from outside.

Client companies report their own leaks

Companies that used the service have begun announcing their own exposure. The Bic Camera Group, which covers Bic Camera, Kojima and Sofmap, reported a combined 14.9 million affected records. Asoview reported about 15.82 million.

People who have accounts with companies that used Arara Message should be cautious about unexpected emails that ask them to confirm usage or billing details. The service remains suspended while the investigation continues.