SecurityNov 4, 2026, 4:21 AM UTC·2 min read

Asoview Confirms 15.8 Million Member Records Leaked via Arara

Japanese leisure booking site Asoview says 15,821,184 member records were exposed after its email delivery provider Arara suffered unauthorized access.

Illustration of a leaked database and email envelopes representing a data breach affecting a Japanese leisure booking platform. — Image: ITmedia NEWS

SUMO

Dialo

ediviewer

Asoview, the operator of Japan's large leisure booking site Asoview!, announced on November 3 that 15,821,184 member records were leaked after unauthorized access to the service of its email delivery contractor, Arara.

The exposed data belongs to members to whom Asoview sent emails through Arara's "Arara Message" service. Besides email addresses and names, it includes member IDs and numbers, gender, registration date, last login date, postal code and region of residence. Ticket-related details were also affected: purchase date and time, ticket type, number of tickets, number of participants and whether a booking was canceled. The company also lists names of facilities used.

What Asoview is doing

Asoview received a report from Arara on November 2. The same day, it stopped all email delivery that uses Arara Message and invalidated credentials such as admin-console passwords and API keys. It is also checking whether its own systems were accessed without authorization.

At this point, the company cannot tell which members the leaked email addresses belong to. Arara is identifying the affected people, and Asoview plans to match that information against its records and contact affected members individually.

The company said it will review its criteria for selecting outside contractors and external services, limit the data it entrusts to partners to the necessary minimum, and tighten oversight of them.

Why it matters

According to the company's latest news release, dated October 22, Asoview has more than 23 million members and lists 28,000 plans, from amusement parks and aquariums to outdoor activities, with e-tickets bookable on its site and app. The leak therefore touches a large share of its user base.

Members should be alert to suspicious emails and messages that may exploit the leaked details, especially since the information covers activity and booking history. The incident also adds to a run of Japanese breaches traced to third-party email and delivery vendors.