ARARA · CMP-202611-ec7w4w · Vendor
NO FIX YET · SEE WHAT TO DO
ARARA, a Japanese email distribution (newsletter) service, disclosed on 2 Nov 2026 that attackers breached its email distribution service, exposing 77 million email addresses from nearly 380 corporate clients. A web server vulnerability and problems in its system environment contributed; the exact intrusion method and timing are still under investigation. In late October the attackers also used ARARA's service to send over 7 million emails impersonating credit card companies. Confirmed exposed clients: SEGA / SEGA Fave (2.2M newsletter subscriber emails across 11 newsletters, plus 92,300 records with additional data still being determined; disclosed 9 Nov), MOS Burger (7.5M emails), Shochiku Multiplex Theatres (3.3M records), TKC (2.3M emails), IIJmio (nearly 1M emails). SEGA says names, addresses, phone numbers, card details and passwords were not in the SEGA data, and that this is unrelated to its ALL.Net arcade incident. Attacker unknown (BleepingComputer, 9 Nov).
first public Nov 9, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Posts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.