Asoview Says 15,821,184 Records Were Exposed in Arara Message Breach

Asoview says 15,821,184 records—not 15.8 million unique people—were exposed through the Arara Message breach. Here is what was involved, what users should do and what remains unknown.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

Centered translucent shield and server stack split by a red-orange breach, with email envelopes and profile cards moving along blue and red network paths.
AI-generated editorial illustration of a shielded server stack split by a breach, with email and profile records moving across network paths. Not official Asoview or Arara imagery.

Asoview Says 15,821,184 Records Were Exposed in Arara Message Breach13

Asoview says 15,821,184 records tied to members who received email through Arara Message were exposed.1 The number is a record count, not a verified count of unique people or accounts.1

SECURITY NOTICE • Reporting cutoff: November 4, 2026, 2:55 a.m. EST / 2026-11-04T07:55:55Z

The bottom line

The exposed Asoview dataset included contact, profile and ticket-use information.1 Asoview says passwords and credit-card information were not in that entrusted dataset.1

Verified facts

Asoview records15,821,184 records; Asoview had not yet identified which members the leaked email addresses belonged to.1
Provider-wide email addressesArara reported about 77 million email-address records under review, not 77 million unique end users.2
Service statusArara stopped Arara Message on October 31, and the restart date was undetermined.2

What happened

Arara says a third party accessed an Arara Message server and used it to enter numerous service servers and exfiltrate database contents between October 28 and October 31.2 The company linked the incident to a Web-server vulnerability and system-environment problems, while the exact intrusion start and route remained under investigation.2

Why it matters

Asoview lists email address; member ID and number; name; sex; birth date; registration and last-login dates; phone number; postal code; region; and ticket purchase, facility, use, participant and cancellation information among the affected fields.1 Asoview warned that the exposed information could be misused in suspicious email, SMS and calls impersonating the company.1

What the counts mean

Figure What it measures
15,821,184 Asoview records associated with members to whom it sent email through Arara Message; not a verified unique-person count.1
About 77 million Provider-wide email-address records still under review; Arara says one person may hold multiple addresses.2
Up to about 7.13 million Up to about 7.13 million suspicious messages impersonating a card company.2

Timeline

  • October 27–28: Arara records unauthorized access to the previously disclosed shared environment.2
  • October 28–31: Arara records access through the service into client environments.2
  • October 31: Arara invalidated misused credentials, blocked server communications and stopped the service.2
  • November 2: Asoview stopped all email delivery through Arara Message and invalidated its management-console password, API keys and other service credentials.1

What this means for readers

Asoview warns that the exposed information could be used in messages or calls impersonating the company.1

  • Practical guidance: If an unexpected email or SMS arrives, do not open its URL; delete the message.1
  • Practical guidance: Avoid responding to suspicious calls.1
  • Practical guidance: If you entered card information at a site reached through a suspicious message, contact the card issuer promptly.1

What remains unknown

Scope: The final number of affected people or accounts is unknown, and Arara says its provider-wide count remains under review.12

Cause: Arara said the intrusion start and route remained under investigation.2

Asoview systems: Asoview said it began investigating whether its own systems were accessed.1

Sources

  1. Asoview: 委託先メール配信サービスへの不正アクセスに関するお詫びとお知らせ — published and updated November 3, 2026.
  2. Arara: 当社が提供する「アララメッセ－ジ」への不正アクセスによる情報流出およびサービス停止について（第２報） — November 2, 2026.
  3. ITmedia NEWS: メルアド7700万件流出か　アララメッセージの不正アクセスで続報　共通環境から契約企業のサーバへ侵入　悪用も確認 — November 4, 2026.

Update and correction note: This report is bounded to the cited sources and reporting cutoff.

Browse Articles

Latest Articles