When attackers break into the service that sends your customer emails, they get your list and your voice.
Paycloud Holdings, parent of the Japanese email delivery service Arara Message, disclosed on November 2 that unauthorized access to its infrastructure potentially affected 97 servers and about 380 client companies. Approximately 77 million email addresses may have been exposed. The company stresses that the figure counts addresses, not individual people.
Phishing from a trusted sender
Attackers also used the platform to send up to 7.13 million suspicious emails between October 28 and 30. The messages impersonated credit card companies, came from the address [email protected] and asked recipients to confirm account usage and billing statements, eSecurity Planet reports.
Arara blocked traffic from affected environments, invalidated compromised credentials and says no new suspicious emails went out after October 30. It shut down the entire service on October 31 and has not announced a restart date.
Wider impact
An earlier disclosure involving a shared environment affected 61 companies and 3,386,187 email addresses, with up to 411,827 customer records containing more personal details taken from five companies. Arara says it will require clients to reset admin passwords, API keys and other credentials before service resumes, and has reported the incident to Japanese authorities and police.
Why it matters
Email service providers hold customer lists for hundreds of brands and can send mail that passes as legitimate. That makes them a high-value target and a classic concentration risk.
Every company using a third-party email platform should review vendor security, API key hygiene and sender authentication. For email security and vendor-risk providers, this incident is a timely, concrete example for outreach to marketing and IT leaders alike.
Sources: eSecurity Planet, ASCII.jp. Written by the xRapid Media LLP team.
Selling to the IT market? xRapid Media LLP is a High Tech B2B Marketing company. We help technology companies reach decision-makers with verified B2B data, account-based campaigns, email and LinkedIn outreach and appointment setting. Call +91 9767196309 or book a free B2B marketing consultation.