Email marketing platform hacked: 7 million phishing emails sent from a legitimate address
Your SMB sends a newsletter every month, order confirmations, appointment reminders. To do it, you use a sending platform: Mailchimp, Brevo, Cyberimpact, or the one built into your software. Your customers have learned to trust the messages it sends. What if a hacker used that trust?
That’s what just happened in Japan. Arara Message, an email distribution service used by hundreds of companies, was hacked. Between October 28 and 30, 2026, up to 7.13 million phishing emails posing as a credit card company went out from the legitimate address news@arara.com. The service has been completely shut down since October 31.
An email marketing platform hacked: the timeline
According to PayCloud Holdings, which owns the service, the cause combines a web server vulnerability and problems in the system environment. No credit card numbers were stored. The 77 million figure counts addresses, not unique people, and remains provisional.
What the email looked like
Here is a translated, simplified reconstruction based on the subject lines published by Arara. The markers show why this kind of message works so well:
Why it fools people
- 1The sending address is real: filters and people already know it.
- 2Urgency and the threat of suspension push people to click without thinking.
- 3The link leads to a fake site asking for the card number and codes.
Key lesson: SPF and DKIM only confirm that the message really comes from the platform. They don’t say the content is honest. When the platform itself is compromised, these checks pass.
Three misconceptions to drop
❌ Myth 1
“If the email comes from a known address, it’s safe.”
✅ Fact 1
A legitimate address can send a fake message if the account or platform is hacked. Always check by opening the site or app yourself, never through the email link.
❌ Myth 2
“Our provider’s breach is their problem.”
✅ Fact 2
It’s your customers who receive the phishing in your name, and their addresses that leak. Under Quebec’s Law 25, you remain responsible for personal information entrusted to a provider.
❌ Myth 3
“We only gave them email addresses.”
✅ Fact 3
At Arara, the attacker went through the service to reach client servers. Names, company names and other member data were also exposed.
We covered a similar case with the data breach at the vendor Navigate360: your data also lives with your vendors, and their security becomes yours.
Your checklist for this week
Your email sending platform
- ☐ Turn on two-factor authentication for every user on the account, and remove former employees.
- ☐ Inventory API keys and integrations (website, online store, CRM); delete those no longer used and rotate the others.
- ☐ Limit rights: only a few people can send a campaign to the whole list.
- ☐ Turn on alerts for any new sign-in, new key or unusual campaign.
- ☐ Check what the platform keeps: only useful fields, no birth dates or unnecessary notes.
- ☐ Plan a backup route for critical messages (confirmations, password resets) if the service stops.
- ☐ Prepare a template message to warn your customers if your platform is affected.
- ☐ Add the provider to your Law 25 register, with its incident contact.
On the receiving side, remind your team that an email asking for urgent action on an account or a card is always verified another way. A good Microsoft 365 setup also helps: filters, banners on external messages and one-click reporting.
How NeoTech can help
Our cybersecurity services include reviewing your cloud provider accounts (including your newsletter platform), two-factor authentication, cleaning up API keys, and setting up SPF, DKIM and DMARC for your domain. Our automated 24/7 monitoring with on-call technician intervention spots abnormal sign-ins to your accounts and waves of suspicious emails.
Book your free cyber check
In 30 minutes, we look together at which providers send email in your name, who has access to them, and how to react if one of them is hacked.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Arara — Report on the email distribution service incident, November 2, 2026 (in Japanese)
- Nippon.com (Jiji Press) — 77 M. Email Addresses Leak from Arara Message Due to Cyberattack, November 2, 2026
- Security.io — Arara breach expands from one mail system to 97 client servers
- Nikkei xTECH — Arara leak: about 77 million more addresses, up to 7.13 million suspicious emails (in Japanese)
Photo: Maksim Goncharenok, Pexels (Pexels licence).