Japan: up to 77 million email addresses potentially exposed after the hack of the “Arara Message” sending service
Checked on
Published on
- Up to about 77 million email addresses may be exposed after the unauthorised access to Arara Message (up to 380 companies).
- The intrusion ran from 28 to 31 October; 97 servers were affected, and the service has been fully suspended since 31 October.
- Up to about 7.13 million fake emails posing as card companies; do not open the links.
- Asoview announces the exposure of 15.82 million records; the figures are not a number of victims and are still being verified.
In this article
What was announced
According to ITmedia NEWS (4 November), Paycloud Holdings announced on 2 November a new stage in the unauthorised access to the email-sending service “Arara Message” of its subsidiary Arara (Minato, Tokyo): about 77 million email addresses were or may have been exposed, at up to about 380 client companies. At the 29 October announcement the figure was about 3.01 million; it was later raised to 3,386,187.
The intrusion and the data involved
The attackers broke in between 28 and 31 October, going through Arara Message’s servers to reach the client companies’ systems. Email addresses and member information were reportedly taken from 97 servers; a flaw in the web server and problems in the system environment are mentioned. Depending on the client, the data includes names, sex, dates of birth, phone numbers, member numbers and addresses. The figures are being verified. Since one person can have several addresses, they do not correspond to the number of victims. The data of customers of five companies (up to 411,827) is also affected, but it is not added in because it may overlap with the 77 million.
Misuse and measures taken
Between 28 and 30 October, up to about 7.13 million fraudulent emails posing as credit card companies were sent from “[email protected]”, with subjects such as “request to confirm your usage”; people are asked not to click the links. The company invalidated the credentials that had been misused, cut the servers’ communications and fully suspended the service from 31 October, with no restart date. It says its other services are not affected.
Effects on other companies
According to ITmedia, Asoview announced on 3 November the exposure of 15,821,184 member records (email addresses, names, phone numbers, ticket purchase dates, names of facilities used; passwords and bank cards excluded). For the Bic Camera group, we saw only a headline mentioning the possible leak of about 14.9 million email addresses through a contractor, and could not verify the details. If you receive a suspicious email, it is better not to open the links and to go through the official site.
Learn the grammar
French grammar
Learn sentence patterns and usage from the article’s own sentences.
01Negation and its scope
ne / n’ … pas · ne … plus
Ce qui est établi et ce qui ne l’est pas.Key pointsNormally ne and pas wrap the verb. Before a vowel, ne becomes n’. Check which part of the sentence the negation covers. Ne … plus means “no longer”.
02Citing a source with selon
selon + noun / organisation
Selon ITmedia NEWS (4 novembre), Paycloud Holdings a annoncé le 2 novembre une nouvelle étape dans l’accès frauduleux au service d’envoi d’e-mails « Arara Message » de sa filiale Arara (Minato, Tokyo) : environ 77 millions d’adresses e-mail ont été ou pourraient avoir été exposées, chez un maximum d’environ 380 entreprises clientes.Key pointsSelon means “according to”. Put a person or organisation after it as the source. It separates facts the writer checked directly from what another body or report said. Citing a source does not turn a forecast into an accomplished fact.
03Pouvoir: ability and possibility
peut / peuvent / pourrait + infinitive
Le 2 novembre, Paycloud Holdings a annoncé que près de 77 millions d’adresses e-mail pourraient avoir été exposées par le service d’envoi d’e-mails de sa filiale Arara.Key pointsPut a base-form verb after pouvoir. Peut means “can” or “may”; the conditional pourrait gives a more reserved possibility, “might”. It does not necessarily mean implementation is settled.
04Purpose with pour
pour + infinitive
Les attaquants se sont introduits entre le 28 et le 31 octobre, en passant par les serveurs d’Arara Message pour atteindre les systèmes des entreprises clientes.Key pointsThis is the purpose, “in order to…”. Put the base form of a verb after pour. The purpose stated here is separate from whether the effect was actually achieved.
05The passé composé for events
present of avoir + past participle
Selon ITmedia, Asoview a annoncé le 3 novembre la fuite de 15 821 184 données de membres (adresses e-mail, noms, numéros de téléphone, dates d’achat de billets, noms des sites utilisés ; mots de passe et cartes bancaires exclus).Key pointsIt reports past events, as in “announced” or “explained”. A / ont is the auxiliary avoir and the next word is the past participle. The passé composé alone does not tell you the date of the event.
06The present of être
est / sont + complement
Des adresses e-mail et des informations de membres auraient été sorties de 97 serveurs ; une faille du serveur Web et des problèmes de l’environnement système sont évoqués.Key pointsEst is third-person singular and sont third-person plural of être. They express “is / are” — a state or description. If a past participle follows, it is a different structure such as the passive, so check the words that follow.
Japanese grammar
Understand the structure and usage from the text.
01Citing a source: によると
noun + によると
ITmedia NEWS（4日）によると、ペイクラウドホールディングスが11月2日に、連結子会社アララ（東京都港区）のメール配信サービス「アララメッセージ」への不正アクセスについて、新たに発表しました。Key pointsAs in “LCPによると”, it shows where the information comes from. What that source reported follows. It is used differently from “私にとって”, which gives one’s own opinion.
02Expressing a possibility
〜可能性がある / 〜かもしれない
件数は精査中で、変わる可能性があります。Key pointsThese forms say something may happen. Even when “possibility” is written, it does not mean it will certainly happen. Check whose forecast it is, plus the time and conditions.
03Polite negation and plain form
〜ではありません / 〜ではない
1人が複数のアドレスを持つことがあるため、件数は被害者の人数ではありません。Key pointsThey negate a noun and similar content. “ではありません” is the polite form and “ではない” the plain form. “成立ではありません” shows that it cannot be said to have been concluded.
04Indicating the subject: について
noun + について
ビックカメラグループについては、「メールアドレスなど約1,490万件が漏えいの可能性、委託先への不正アクセス」という見出しだけを確認し、詳しい内容は確認できませんでした。Key pointsAs in “予算について”, it shows the topic to be talked about or explained. In the form “〜についての報道”, の is added so that the group qualifies the following noun.
05Cause or purpose with ため
〜ため / 〜ために
1人が複数のアドレスを持つことがあるため、件数は被害者の人数ではありません。Key pointsため is used for both reason and purpose. “成立ではないため” is a reason and “運転手を守るため” a purpose. Decide from the whole sentence whether what precedes is a cause or a goal.
06Giving examples with など
noun / expression + など
持ち出された情報は、氏名、性別、生年月日、電話番号、会員番号、住所などで、項目は契約企業によって違います。Key points“暴言など” gives “abusive language” as one example. It is not necessarily a closed list of only the things named. It also helps when reading the scope of a news story.