{"id":"CMP-202611-ec7w4w","kind":"campaign","aliases":[],"related":[],"title":"Japanese email delivery service ARARA breached: 77 million email addresses of nearly 380 client companies (SEGA, MOS Burger, IIJmio, TKC, Shochiku) exposed, and its service used to send 7M+ fake credit card company emails","description":null,"summary":"ARARA, a Japanese email distribution (newsletter) service, disclosed on 2 Nov 2026 that attackers breached its email distribution service, exposing 77 million email addresses from nearly 380 corporate clients. A web server vulnerability and problems in its system environment contributed; the exact intrusion method and timing are still under investigation. In late October the attackers also used ARARA's service to send over 7 million emails impersonating credit card companies. Confirmed exposed clients: SEGA / SEGA Fave (2.2M newsletter subscriber emails across 11 newsletters, plus 92,300 records with additional data still being determined; disclosed 9 Nov), MOS Burger (7.5M emails), Shochiku Multiplex Theatres (3.3M records), TKC (2.3M emails), IIJmio (nearly 1M emails). SEGA says names, addresses, phone numbers, card details and passwords were not in the SEGA data, and that this is unrelated to its ALL.Net arcade incident. Attacker unknown (BleepingComputer, 9 Nov).","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-09T22:28:26+00:00","products":[{"name":"ARARA","fixed":[],"vendor":"ARARA","ecosystem":"saas"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Did your company send newsletters or marketing email through ARARA? Ask ARARA whether your lists were in the 77M exposed addresses. For people: if you subscribed to SEGA/SEGA Fave, MOS Burger, Shochiku Multiplex Theatres (SMT), TKC or IIJmio newsletters, expect your address to be exposed. A forwarded email that claims to be from a credit card company and came through a newsletter-style sender in late October 2026 or later may be from this wave; the sender domains, link domains and subject lines have not been published (unknown).","fix":"Companies using ARARA: get the list of exposed data from ARARA, warn subscribers, and check that no mail was sent from your sender account that you did not schedule. People: do not click links or log in from emails claiming to be your credit card company; go to the card issuer's site or app directly. Expect more targeted phishing to these addresses.","status":"open","published_at":null,"first_seen_at":"2026-11-09T22:28:26+00:00","triaged_at":"2026-11-09T22:28:26+00:00","updated_at":"2026-11-09T22:28:49+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-09T22:31:13Z","path":"phishing","entry":"unpatched-vuln","reason":"The summary says 'A web server vulnerability and problems in its system environment contributed; the exact intrusion method and timing are still under investigation,' and the fake credit card company emails were sent through ARARA's own distribution service, which reached recipients as phishing.","confidence":0.6}},"analyst_status":"done","analyst_note":null,"search":"'-202611':36A '11':125B '1m':157B '2':52B '2.2':119B '2.3':152B '2026':54B '3.3':148B '300':129B '380':13A,69B '7':106B '7.5':142B '77':7A,63B '7m':29A '9':138B,188B '92':128B 'across':124B 'addit':132B 'address':10A,66B,162B 'all.net':182B 'also':98B 'arara':5A,38A,43B,100B 'arcad':183B 'attack':56B,97B,185B 'bleepingcomput':187B 'breach':6A,57B 'burger':18A,141B 'campaign':39B 'card':32A,111B,165B 'client':14A,71B,115B 'cmp':35A 'compani':15A,33A,112B 'confirm':113B 'contribut':82B 'corpor':70B 'credit':31A,110B 'data':133B,174B 'deliveri':3A 'detail':166B 'determin':136B 'disclos':50B,137B 'distribut':47B,60B 'earli':41B 'early-warn':40B 'ec7w4w':37A 'email':2A,9A,34A,46B,59B,65B,108B,123B,144B,154B,158B 'environ':81B 'exact':84B 'expos':22A,62B,114B 'fake':30A 'fave':118B 'iijmio':19A,155B 'imperson':109B 'incid':184B 'intrus':85B 'investig':92B 'japanes':1A,45B 'late':94B 'm':120B,143B,149B,153B 'method':86B 'million':8A,64B,107B 'mos':17A,140B 'multiplex':146B 'name':161B 'near':12A,68B,156B 'newslett':48B,121B,126B 'nov':53B,139B,189B 'number':164B 'octob':95B 'password':168B 'phone':163B 'plus':127B 'problem':77B 'record':130B,150B 'say':160B 'sega':16A,116B,117B,159B,173B 'send':28A,104B 'server':74B 'servic':4A,25A,49B,61B,102B 'shochiku':21A,145B 'still':90B,134B 'subscrib':122B 'system':80B 'theatr':147B 'time':88B 'tkc':20A,151B 'unknown':186B 'unrel':179B 'use':26A,99B 'vulner':75B 'warn':42B 'web':73B","nicknames":["ARARA breach"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["arara","ararabreach"],"ptokens":["arara"],"labels":["campaign","earlywarning","medium","vendor"],"campaign_type":"breach","search_a":"'-202611':36A '380':13A '77':7A '7m':29A 'address':10A 'arara':5A,38A 'breach':6A 'burger':18A 'card':32A 'client':14A 'cmp':35A 'compani':15A,33A 'credit':31A 'deliveri':3A 'ec7w4w':37A 'email':2A,9A,34A 'expos':22A 'fake':30A 'iijmio':19A 'japanes':1A 'million':8A 'mos':17A 'near':12A 'sega':16A 'send':28A 'servic':4A,25A 'shochiku':21A 'tkc':20A 'use':26A","search_b":"'11':125B '1m':157B '2':52B '2.2':119B '2.3':152B '2026':54B '3.3':148B '300':129B '380':69B '7':106B '7.5':142B '77':63B '9':138B,188B '92':128B 'across':124B 'addit':132B 'address':66B,162B 'all.net':182B 'also':98B 'arara':43B,100B 'arcad':183B 'attack':56B,97B,185B 'bleepingcomput':187B 'breach':57B 'burger':141B 'campaign':39B 'card':111B,165B 'client':71B,115B 'compani':112B 'confirm':113B 'contribut':82B 'corpor':70B 'credit':110B 'data':133B,174B 'detail':166B 'determin':136B 'disclos':50B,137B 'distribut':47B,60B 'earli':41B 'early-warn':40B 'email':46B,59B,65B,108B,123B,144B,154B,158B 'environ':81B 'exact':84B 'expos':62B,114B 'fave':118B 'iijmio':155B 'imperson':109B 'incid':184B 'intrus':85B 'investig':92B 'japanes':45B 'late':94B 'm':120B,143B,149B,153B 'method':86B 'million':64B,107B 'mos':140B 'multiplex':146B 'name':161B 'near':68B,156B 'newslett':48B,121B,126B 'nov':53B,139B,189B 'number':164B 'octob':95B 'password':168B 'phone':163B 'plus':127B 'problem':77B 'record':130B,150B 'say':160B 'sega':116B,117B,159B,173B 'send':104B 'server':74B 'servic':49B,61B,102B 'shochiku':145B 'still':90B,134B 'subscrib':122B 'system':80B 'theatr':147B 'time':88B 'tkc':151B 'unknown':186B 'unrel':179B 'use':99B 'vulner':75B 'warn':42B 'web':73B","search_c":"","cause_entry":"unpatched-vuln","cause_path":"phishing","disclosures_checked_at":"2026-11-09T22:35:20+00:00","first_public_at":"2026-11-09T22:09:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-ec7w4w","url":"https://www.bleepingcomputer.com/news/security/sega-newsletter-data-breach-exposes-22-million-email-addresses/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-09T22:28:26+00:00","fetched_at":"2026-11-09T22:28:26+00:00","note":null,"cites":["https://www.bleepingcomputer.com/news/security/sega-newsletter-data-breach-exposes-22-million-email-addresses/"]}],"documents":[{"id":110228,"url":"https://x.com/BleepinComputer/status/2119915381703709133","title":"@BleepinComputer: SEGA newsletter data breach exposes 2.2 million email addresses\nhttps://t.co/Yz8","kind":"post","source":"x","publisher":null,"text":"SEGA newsletter data breach exposes 2.2 million email addresses\nhttps://t.co/Yz8AzkK2W0\n\nhttps://t.co/Yz8AzkK2W0\n\nlikes 12 reposts 2","published_at":"2026-11-09T22:09:47+00:00","relation":"describes","confidence":null,"note":null},{"id":110309,"url":"https://www.bleepingcomputer.com/news/security/sega-newsletter-data-breach-exposes-22-million-email-addresses/","title":"BleepingComputer: SEGA newsletter data breach exposes 2.2 million email addresses","kind":"blog","source":"analyst","publisher":null,"text":"SEGA disclosed that a data breach at its third-party newsletter provider ARARA exposed the email addresses of 2.2 million subscribers of 11 SEGA and SEGA Fave newsletters, plus 92,300 records with additional information yet to be determined. No names, birth dates, addresses, phone numbers, card details or passwords; SEGA Account emails use a separate system and are not affected. ARARA disclosed on 2 Nov that a breach of its email distribution service compromised 77 million email addresses from nearly 380 corporate clients; a web server vulnerability and problems in its system environment contributed; exact intrusion method and timing still under investigation. ARARA told SEGA on 29 Oct no data was compromised, then on 3 Nov found otherwise. Attackers abused access to ARARA's service to send over 7 million emails impersonating credit card companies in late October. Other victims: MOS Burger (7.5M email addresses), Shochiku Multiplex Theatres (3.3M records), TKC (2.3M email addresses), IIJmio (nearly 1M email addresses). SEGA says unrelated to the ALL.Net/Aime arcade incident.","published_at":"2026-11-09T22:09:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}