Arara email service breach potentially exposes 77 million addresses

Arara, a subsidiary of Paycloud Holdings, has reported a significant data breach involving its email delivery service, Arara Message. Following an initial report of 3 million leaked addresses, the company updated its findings on November 2, stating that approximately 77 million email addresses may have been compromised through unauthorized access to 97 servers.

The breach affects an estimated 380 companies. In addition to email addresses, the stolen data may include names, genders, dates of birth, phone numbers, membership numbers, and addresses, depending on the specific client. Arara confirmed that it does not hold credit card information.

Beyond data theft, the service was exploited to send approximately 7.13 million phishing emails between October 28 and October 30. These fraudulent messages, which impersonated credit card companies, were sent from an Arara domain to addresses provided by the attackers.

Arara has suspended all service operations indefinitely while investigating the cause, which is attributed to web server vulnerabilities and systemic environment issues. The company has notified the Personal Information Protection Commission and the police.