What happened
PayCloud Holdings issued its second report on 2 November 2026 after the weekend investigation materially expanded the incident scope. The change reverses the practical conclusion of Arara’s 30 October 2026 update, which said no leakage had been found in other environments. Arara completed the full service shutdown at 19:53 on 31 October 2026; the restart date was not published. PayCloud Holdings said the affected scope had expanded from one shared system to 97 servers in client environments, with up to about 380 contracted companies potentially involved.
The company counted about 77 million email addresses in the newly identified server set, while warning that the figure is provisional and is not a count of unique people. The previously disclosed shared environment involved 3,386,187 unique email addresses across 61 client companies, plus up to 411,827 customer records containing names, company names or other registered attributes for five clients. TKC separately disclosed on 2 November 2026 that up to 2,230,812 email addresses belonging to users of its systems were included in the leak scope.
Between 28 and 30 October 2026, the compromised delivery service sent up to about 7.13 million phishing emails from with subjects including 「利用内容確認のご依頼」 and 「ご利用明細確認のご依頼」. The shutdown covered Arara Message GUI, API v1, API v2 and the ASP repica editor, sender and auto-mail services; on-premises repica products were excluded. The combined effect is confirmed data loss, abuse of a trusted sending service and an open-ended interruption to customer communications.
PayCloud revised the stated cause from a web-server vulnerability alone to a web-server vulnerability plus problems in the system environment; no CVE identifier was published. The cited sources did not publish an exploit artefact, attacker IP address, malware sample or command sequence for the intrusion. Attribution posture: PayCloud Holdings says the related activity appears to have come from the same unidentified third party because attack origins overlapped; no actor identity has been established.
Why this matters now
This is no longer a conventional processor breach limited to a provider-held mailing list. PayCloud says the attacker used the Arara service as a path into client-company server environments. That changes the enterprise question from whether a supplier lost contact data to whether an upstream platform enabled data extraction from customer-controlled databases and whether any connected credentials or trust relationships remain usable.
The same platform was also used to distribute card-themed phishing from a legitimate Arara address. Recipient controls based mainly on sender reputation or allowlisting may therefore have treated malicious messages as trusted. Organisations must correlate email telemetry, user reports and downstream fraud indicators rather than relying on the provider’s containment statement alone.
The weekend scope expansion invalidates assurance based on Friday’s narrower update. Contract owners, privacy teams and application owners now need tenant-specific facts: whether their environment was among the 97 servers, which fields were removed, which authentication material existed in the service and whether critical customer communications remain available during the indefinite shutdown.
The decision for security leaders
Establish one incident workstream joining security, privacy, legal, procurement, application ownership and communications. The provider’s aggregate figures cannot determine your obligations or compromise status; only a tenant-specific record of systems, data fields, access times and credentials can support a defensible decision.
Separate supplier containment from enterprise closure. A stopped service prevents further delivery, but it does not establish that previously extracted data, API keys or administrative credentials cannot be reused. Require revocation evidence and internal validation before reconnecting any integration.
Preserve customer-notification and authentication continuity while the platform remains unavailable. Prioritise password resets, fraud alerts, one-time codes and regulatory messages, and ensure the alternate route does not reuse credentials or trust relationships potentially exposed through Arara.
Evidence of closure
- Vendor assurance identifies whether each enterprise environment was among the 97 servers.
- Revocation records prove every former Arara API key and administrator credential is rejected.
- Mail-search results document treatment of and the published subjects.
- A tested alternate route delivers each business-critical transactional message class.
The Security.io assessment
The high-level incident is well supported by PayCloud, Arara, an affected customer and independent reporting. The principal uncertainty is scope precision: 77 million is an address count, not a unique-person count, and the estimated maximum of about 380 companies remains provisional.
The provider has not supplied the technical evidence needed for independent compromise assessment. Without an entry path, CVE, attacker infrastructure or commands, customers cannot close the incident through signature matching; they need supplier-specific evidence, credential revocation and review of their own connected systems.
The development ranks first because the weekend changed three executive assumptions simultaneously: the breach crossed into client environments, the platform’s trusted delivery function was weaponised and the entire service became unavailable. That combination creates immediate security, legal, fraud and continuity decisions across multiple enterprises.
Questions for the morning meeting
- Which customer, employee and transactional communications depend directly or indirectly on Arara Message?
- Can the organisation identify every API key, administrator credential and sending-domain authorisation connected to the service?
- Who owns tenant-specific scope confirmation, notification decisions and customer communications?
- Can critical authentication and regulatory messages move to an independently controlled delivery route today?