Faccloud says 77 million email addresses affected in Arara Message breach

Faccloud Holdings said in an official second notice on November 2, 2026, that about 77 million email addresses were leaked or possibly leaked from its corporate email sending service Arara Message, up from an initial figure of about 3.01 million, according to dailysecu.com.

The company confirmed data exfiltration on 97 servers related to contract companies, with the number of affected companies estimated at up to about 380. The leaked data includes email addresses, names, gender, birth dates, phone numbers, member numbers, addresses and delivery records registered by contract companies. Arara said it does not hold credit card numbers in the service.

For the shared environment previously reported as about 3.01 million leaked addresses, the company confirmed 3,386,187 unique email addresses and up to 411,827 pieces of customer data registered by five contract companies were exfiltrated.

Attackers used two environments to send up to about 7.13 million suspected emails impersonating a credit card company between October 28 and 30. Arara invalidated the misused credentials and blocked server communication on October 31, completing a full service shutdown at 7:53 pm that day.

The service restart date is undetermined. The company said it will decide after investigating the intrusion route and verifying system safety, and plans a third notice with the accurate leak scale and scope after further investigation.