Arara raises reported email breach scope to as many as 77 million addresses

Japanese email service provider Arara said attackers exfiltrated as many as 77 million email addresses across 380 client organisations, expanding its initial estimate of approximately 3.01 million addresses. The compromised information included names and email addresses. Arara disconnected an affected server, brought in external cybersecurity experts and notified law enforcement. It suspended the service on October 31, 2026, and has not decided when operations will resume. Cryptocurrency exchange Zaif confirmed exposure of 380,536 customer email addresses through the incident. It said its own systems remained secure and that no names, addresses, trading records or passwords were compromised.