Bic Camera Group: 14.9 Million Email Addresses May Have Leaked

A wider breach at the email provider

Arara said the same day that about 77 million email addresses may have leaked from its "Arara Message" email delivery service. It estimates up to roughly 380 client companies were affected, and for some of them names and addresses were also exposed. Arara's systems were also found to have sent up to about 7.13 million emails impersonating credit card companies between October 28 and 30.

Asoview, which runs a leisure and experience booking service, said on November 3 that about 15.82 million member records had leaked in the same incident.

Why it matters

Unauthorized access to email delivery services has been recurring since October. Arcadia, which delivers disaster-prevention information for local governments, along with Yumeru Link and Rakus Light Cloud, the operator of Blast Mail, have also disclosed leaks or possible leaks.

The case shows how a single outsourced vendor can expose the customer data of hundreds of companies at once. For consumers, the main risk is phishing: leaked addresses can be used to send convincing fake messages, so unexpected emails that appear to come from retailers or card issuers should be treated with caution.