Arara Message breach exposes 81 million email addresses in Japan

A break-in at Arara Message, a Japanese email marketing service, has exposed 81.3 million email addresses belonging to the customers of the companies and public bodies that use it, according to the provider. In its third report, published on 6 November, Arara Inc. says 47 million of those addresses were taken together with member data its clients had stored, which depending on the client can include names, sex, dates of birth, phone numbers, membership numbers and home addresses. The service has been shut down since 31 October and Arara says on its incident page, last updated on 11 November, that it still has no date to restart.

From one environment to 97 servers

The scale grew with each report. The first notice, on 29 October, described about 3 million email addresses taken from a shared environment through a web server vulnerability. The second report, on 2 November, said the cause was that vulnerability plus problems in the system environment, and that the same intruder, judging by the common origin of the attacks, had used Arara's own servers to get into 97 servers running dedicated environments for individual clients between 28 and 31 October, copying their databases. Arara estimates the clients affected at up to about 380 companies. It cut off the stolen credentials and stopped the whole service at 19:53 on 31 October.

In the shared environment, the second report says the intruder logged in to the admin screen on 28 October and used the data export function to take the records; Arara now says 27 October activity looks like reconnaissance. The third report added 3,249,492 addresses copied from a second cloud environment with the stolen credentials during the same four days. Arara counts 81,329,467 unique addresses across all of it and stresses that this is a count of addresses, not people. It does not hold card numbers.

Phishing sent through the service

The intruder also used the service to send mail. Between 28 and 30 October up to about 7.13 million phishing emails went out from Arara's own address, news@arara.com, posing as a credit card company with subjects asking recipients to confirm their card usage. Arara says those messages went to addresses the intruder brought in from outside, and it tells anyone who entered card details to contact their card issuer.

Clients are disclosing their share

Client disclosures are now arriving. SEGA said on 9 November that 2,196,044 email addresses used for its and SEGA Fave's newsletters were taken, NHK reported; SEGA says names, payment details and passwords were not involved. According to GameBusiness, SEGA had first been told on 29 October that no leak was confirmed, and learned otherwise on 3 November. Arara has also had to correct what it told some clients: on 6 November it said data was copied continuously from 28 October until the shutdown, not only on 28 and 29 October, so the affected range for some clients was larger than first reported.

What is not known

Arara has not named the vulnerability, said how the intruder first got in or when the intrusion began, or given a final list of affected clients. It has reported the incident to the Personal Information Protection Commission, the police and JIPDEC, and says clients will have to reset admin passwords and API keys when the service returns.