Arara email service data breach

Arara, a subsidiary of Paycloud Holdings, reported a significant data breach involving its email delivery service, Arara Message. The company initially reported 3 million leaked addresses but later updated the figure to approximately 77 million email addresses potentially compromised through unauthorized access to 97 servers. The breach affects an estimated 380 companies. Stolen data may include names, genders, dates of birth, phone numbers, membership numbers, and addresses. Additionally, the service was used to send approximately 7.13 million phishing emails impersonating credit card companies between October 28 and October 30. Arara suspended all service operations indefinitely to investigate vulnerabilities.

On November 3, Asoview, an operator of the leisure and entertainment booking service “Asoview!”, announced that the breach of the Arara Message service exposed 15,821,184 of its member records. Compromised information includes email addresses, member IDs, names, gender, dates of birth, phone numbers, postal codes, and residential regions. The leak also includes ticket purchase and usage histories, such as purchase dates, ticket types, facility names, and number of participants. Asoview stated that no intrusion into its own internal systems was confirmed and that passwords and credit card information were not leaked. The company has suspended email deliveries via the service and is working to notify affected members.