Arara hack: Mos Burger, Workman, IIJmio… client companies announce data leaks (what has changed)
Checked on
Published on
- Mos Burger (about 7.5 million), Workman (up to 1.45 million), IIJmio (about 983,000) and others announce leaks via Arara.
- Shochiku Multiplex Theaters, Yokohama Rubber and Subway corrected an earlier “no impact” statement.
- These are numbers of e-mail addresses, not victims, and they may overlap: we do not add them up.
- Arara has suspended all its services since 31 October, with no restart date.
In this article
What has changed since our previous article
Our previous article (news-jp-20261104-arara-message-fuite-7700-man-adresses) reported Arara’s announcement (up to about 77 million addresses, at most about 380 client companies). ITmedia NEWS (5 November, 14:11) says client companies have since announced their own leaks. We only give the new companies and figures here. Arara has suspended all its services since 31 October, with no restart date.
Companies that announced leaks by 4 November
Mos Food Service (Mos Burger): 7,517,087 records, namely the e-mail address, age, sex and prefecture of “Mos WEB” members, with no payment or card data; Arara informed it on 4 November. Workman: up to about 1.45 million (addresses of subscribers to the online store newsletter). IIJ (IIJmio): 983,458 (subscribers’ addresses). Duskin: 657,886 (addresses from the “DDuet” members’ site). Sumitomo Realty: 205,208 (addresses of people who asked about apartments, via a subcontractor using Arara).
Companies that corrected an initial “no impact”
Shochiku Multiplex Theaters had said on 29 and 30 October that the “SMT Members” data was not affected; on 2 November Arara told it that another environment had been accessed, and the company announced the leak of 3,320,305 addresses. Yokohama Rubber had first announced no leak; on 3 November it learned that the company names and e-mail addresses of subscribers to its press-release distribution service had leaked. Subway had said on 29 October that customer data was excluded; on 2 November it said it could not rule out that it was included and asked Arara for a new investigation.
Other announcements and unverified points
Other companies have already announced leaks: Kaldi Coffee Farm (820,420, on 3 November), Seijo Ishii (up to 168,630, on 3 November), TKC (up to 2,230,812), Chobirich (1,348,525), three Bic Camera group companies (about 14.9 million possible) and Asoview (15,821,184), among others. These figures are numbers of addresses, not of victims (one person can have several). We do not add up the companies’ figures, because they may overlap. The details of the cause and the prospects of a restart could not be verified. If you receive a suspicious e-mail pretending to come from a credit card company, do not click the links.
Learn the grammar
French grammar
Learn sentence patterns and usage from the article’s own sentences.
01Negation and its scope
ne / n’ … pas · ne … plus
Shochiku Multiplex Theaters avait dit les 29 et 30 octobre que les données « SMT Members » n’étaient pas touchées ; le 2 novembre, Arara l’a informée de l’accès à un autre environnement et l’entreprise a annoncé la fuite de 3 320 305 adresses.Key pointsNormally ne and pas wrap the verb. Before a vowel, ne becomes n’. Check which part of the sentence the negation covers. Ne … plus means “no longer”.
02Pouvoir: ability and possibility
peut / peuvent / pourrait + infinitive
Ces chiffres sont des nombres d’adresses, pas de victimes (une personne peut en avoir plusieurs).Key pointsPut a base-form verb after pouvoir. Peut means “can” or “may”; the conditional pourrait gives a more reserved possibility, “might”. It does not necessarily mean implementation is settled.
03The passé composé for events
present of avoir + past participle
Shochiku Multiplex Theaters avait dit les 29 et 30 octobre que les données « SMT Members » n’étaient pas touchées ; le 2 novembre, Arara l’a informée de l’accès à un autre environnement et l’entreprise a annoncé la fuite de 3 320 305 adresses.Key pointsIt reports past events, as in “announced” or “explained”. A / ont is the auxiliary avoir and the next word is the past participle. The passé composé alone does not tell you the date of the event.
04The present of être
est / sont + complement
Ces chiffres sont des nombres d’adresses, pas de victimes (une personne peut en avoir plusieurs).Key pointsEst is third-person singular and sont third-person plural of être. They express “is / are” — a state or description. If a past participle follows, it is a different structure such as the passive, so check the words that follow.
05Dates and their prepositions
le + 日付 / du … au …
Arara a suspendu tous ses services depuis le 31 octobre, sans date de reprise.Key pointsLe 15 octobre means “on 15 October”. Distinguish the le before a date from the le that marks a weekly habit like a weekday. Du is de + le and au is à + le, so decide the meaning from the verb and period expressions around them. Their role depends on the group: a range of dates, the date of a bulletin or another complement.
06Million and milliard followed by de
number + million(s) / milliard(s) + de + noun
Notre article précédent (news-jp-20261104-arara-message-fuite-7700-man-adresses) rapportait l’annonce d’Arara (jusqu’à environ 77 millions d’adresses, environ 380 entreprises clientes au plus).Key pointsMillion and milliard are nouns, so use de before what is counted. Before a vowel it becomes d’. Mille works differently: look at the quantity as a whole instead of applying the same form.
Japanese grammar
Understand the structure and usage from the text.
01Defining a term with とは
noun + とは
複数の企業の数字を足して全体の被害を出すことは、重複があり得るので、ここでは行いません。Key pointsIt takes up a word, as in “在留資格とは？”, and asks for its meaning. In explanations it is used as “〜とは、…です”. Here the quotation と and the topic は are combined.
02Expressing a possibility
〜可能性がある / 〜かもしれない
サブウェイは、10月29日には顧客データは対象外と説明していましたが、11月2日に含まれる可能性を否定できないとして、アララに再調査を依頼しています。Key pointsThese forms say something may happen. Even when “possibility” is written, it does not mean it will certainly happen. Check whose forecast it is, plus the time and conditions.
03Polite negation and plain form
〜ではありません / 〜ではない
これらの件数は、メールアドレスの数で、被害者の人数ではありません（1人が複数持つことがあるため）。Key pointsThey negate a noun and similar content. “ではありません” is the polite form and “ではない” the plain form. “成立ではありません” shows that it cannot be said to have been concluded.
04Cause or purpose with ため
〜ため / 〜ために
これらの件数は、メールアドレスの数で、被害者の人数ではありません（1人が複数持つことがあるため）。Key pointsため is used for both reason and purpose. “成立ではないため” is a reason and “運転手を守るため” a purpose. Decide from the whole sentence whether what precedes is a cause or a goal.
05Giving examples with など
noun / expression + など
ほかに、カルディコーヒーファーム（82万420件、3日）、成城石井（最大16万8,630件、3日）、TKC（最大223万812件）、ちょびリッチ（134万8,525件）、ビックカメラグループ3社（約1,490万件の可能性）、アソビュー（1,582万1,184件）などが公表しています。Key points“暴言など” gives “abusive language” as one example. It is not necessarily a closed list of only the things named. It also helps when reading the scope of a news story.
06The polite past ました
verb stem (連用形) + ました
前回（news-jp-20261104-arara-message-fuite-7700-man-adresses）は、アララ側の発表（最大約7,700万件、契約企業最大約380社）を伝えました。Key pointsIn “発表しました”, ました makes a verb polite past. The negative is “ませんでした”. Read the actual date together with the date and time in the text.