Paycloud Holdings Data Breach: What Was Exposed

In short: Paycloud Holdings' subsidiary Arara Inc. says a hacker broke into its Arara Message email distribution system and took data including about 77 million email addresses, plus names, phone numbers and addresses from roughly 380 corporate clients, according to Vietnam News Agency's report on Paycloud Holdings' November 2 disclosure. No credit card numbers were taken, but the stolen contact data was used to send about 7.13 million phishing emails impersonating a credit card company. It is not yet known who carried out the attack or exactly whose individual records were taken.

If you have ever given your email address, phone number or home address to a Japanese company that uses Arara's email service, this breach is relevant to you even if you have never heard of Paycloud Holdings or Arara directly. Here is what the companies have confirmed, what remains unknown, and what to do while the picture is still forming.

What data did the Paycloud Holdings breach expose?

Arara, an email distribution service and subsidiary of Tokyo-based Paycloud Holdings, says an attacker got unauthorized access to part of its systems on October 28, 2026, and the server was disconnected from the network as soon as the intrusion was confirmed, according to Arara's own incident notice. That first report, posted the next day, said roughly 3.01 million email addresses belonging to client companies using the affected environment had been taken from one system, and that the service itself was being suspended as part of the response. The number grew substantially: Paycloud Holdings' second report, dated November 2, puts the total at about 77 million email addresses, along with names, phone numbers and addresses depending on which client company's data was involved, per the Vietnam News Agency coverage of that disclosure. That 77 million figure counts email addresses, not individual people — someone can have more than one address in the exposed data, so the real number of affected individuals is likely lower.

Who was affected by the Paycloud Holdings data breach?

Around 380 corporate clients used the Arara Message environment that was breached, according to the same Vietnam News Agency report. Paycloud Holdings' own news page lists both disclosures — the October 29 first report and the November 2 second report — but does not publish a full list of which 380 companies were affected. If you've received marketing or account emails from a Japanese company, your data may have passed through this system; without a published client list, the only way to know for certain is to wait for that company to notify you directly or check its own announcements.

What should I do if my data was exposed?

Act now rather than waiting for full confirmation, since phishing built on this leak is already circulating. Follow these steps:

1. Treat any unexpected email claiming to be from a company you've dealt with as suspicious, especially one asking you to "confirm account activity" — that was the subject line pattern used in roughly 7.13 million phishing emails sent after this breach, per VietnamPlus's report. See our guide on how to spot phishing after a data breach.
2. Don't click links, reply, open attachments, or type your ID, password, or personal information into any email you didn't expect — Arara itself directly warned recipients to delete such messages instead.
3. Change passwords on any account you hold with a company that might have used Arara Message, particularly if you reuse that password elsewhere; see what to do if your password was leaked.
4. Watch your bank and card statements for unusual activity. No card numbers were exposed in this breach, but names, phone numbers and addresses are enough to fuel follow-on scams.
5. Be skeptical of phone calls as well as emails claiming to be from Arara or its corporate clients, which Paycloud Holdings has also flagged as a risk, according to VietnamPlus's report.
6. Check our full action checklist for after a data breach for additional steps.

How many email addresses were leaked, and what isn't known yet?

The confirmed count is about 77 million email addresses, up from an initial estimate of roughly 3.01 million in Arara's first notice, according to VietnamPlus's coverage of Paycloud Holdings' November 2 report. What remains unconfirmed: who carried out the intrusion, and precisely which individuals' data — as opposed to which corporate clients' systems — was taken. Arara has said the cause was a third party exploiting a vulnerability in a web server within part of its system environment, but has not named a suspect or group, and no date for restoring the suspended service has been confirmed.

Was my credit card information exposed?

No. VietnamPlus's report on Paycloud Holdings' disclosure specifically states that no credit card numbers were leaked in this incident. The danger instead comes from the roughly 7.13 million phishing emails sent afterward that impersonated a credit card company, designed to trick recipients into handing over card details voluntarily rather than stealing them directly from Arara's systems.