Japan's Arara Message breach grows to 77M email addresses across up to 380 companies, and the attacker used it to send 7M phishing emails

What's the deal? Japanese email-delivery service Arara Message says attackers copied about 77 million email addresses from its systems, along with names, phone numbers, birth dates and home addresses for some users, depending on what each client company stored. Up to about 380 corporate clients are affected. AraraDealroom has a profile for this one. Try Dealroom → and its parent Paycloud Holdings disclosed the figure on 2 November in a second report on the incident. No credit card numbers were held by the service.

How it grew. Arara's first report on 29 October counted about 3 million email addresses taken from one shared system. The second report says the attacker went on, between 28 and 31 October, from an Arara Message server into 97 servers holding client companies' own setups and copied their databases. Arara blames a web server vulnerability together with problems in how its systems were set up, and says it is still investigating when and how the intrusion began. The 77 million figure counts addresses, not people, and may still change.

Weaponised in real time. The attacker also used Arara Message itself to send up to about 7.13 million phishing emails from the company's own sender address between 28 and 30 October, posing as a credit card company and asking recipients to confirm their statements. Arara shut down the whole service on 31 October and has not said when it will restart.

Not alone. The breach is the biggest in a run of incidents at Japanese companies. On the same day, Suntory said personal data of about 90,000 employees and contractors leaked through an external cloud service, and client companies such as energy group JERA have started warning their own users that data held by Arara may have leaked.

The signal: One small email vendor sat behind hundreds of brands' customer lists. Supply-chain attacks on unglamorous SaaS plumbing can now spill tens of millions of records at once, and the same access lets attackers send fraud from a trusted sender address.

Read more: Arara second report (PDF, Japanese), The Japan Times, Jiji Press via Nippon.com

Image credit: Blogtrepreneur via Wikimedia Commons (CC BY 2.0)