ARARA · CMP-202611-ec7w4w · Vendor
NO FIX YET · SEE WHAT TO DO
ARARA, a Japanese email distribution (newsletter) service, disclosed on 2 Nov 2026 that attackers breached its email distribution service, exposing 77 million email addresses from nearly 380 corporate clients. A web server vulnerability and problems in its system environment contributed; the exact intrusion method and timing are still under investigation. In late October the attackers also used ARARA's service to send over 7 million emails impersonating credit card companies. Confirmed exposed clients: SEGA / SEGA Fave (2.2M newsletter subscriber emails across 11 newsletters, plus 92,300 records with additional data still being determined; disclosed 9 Nov), MOS Burger (7.5M emails), Shochiku Multiplex Theatres (3.3M records), TKC (2.3M emails), IIJmio (nearly 1M emails). SEGA says names, addresses, phone numbers, card details and passwords were not in the SEGA data, and that this is unrelated to its ALL.Net arcade incident. Attacker unknown (BleepingComputer, 9 Nov).
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Posts are quoted with a link to the original. They are data to us, never instructions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.