On the 4th, Japanese cryptocurrency exchange Zaif announced that due to unauthorized access to the 'Arara Message' service provided by its subcontractor Arara, email addresses registered by the company were leaked externally. This follows an initial disclosure of a potential leak on the 2nd, marking this as the second report.
According to Zaif, they received a report from Arara confirming the leak on the night of the 2nd, and on the 4th, they received a list of the leaked email addresses. The number of leaked addresses, excluding duplicates, is 380,536, and it is reported that no personal information such as names or email content was included.
Furthermore, it is possible that the leaked email addresses include those registered in the past, and Zaif is currently verifying the breakdown, including the number of current users affected.
Zaif emphasized that no information other than email addresses was registered with Arara's service, and there was no leak of names, addresses, transaction information, or passwords. No unauthorized access to Zaif's own systems has been confirmed, and it is not possible to log into accounts using only email addresses. At present, no secondary damage such as unauthorized logins or asset leaks has been confirmed.
Meanwhile, due to the suspension of the 'Arara Message' service, Zaif has temporarily halted the distribution of various emails. The company warns that phishing emails impersonating Zaif may be sent to the leaked email addresses and advises customers using email authentication to consider switching to two-factor authentication via an authentication app.
Zaif has reported the incident to relevant authorities and indicated plans to improve, including reviewing its subcontractors.
On the 29th of last month, Arara announced that one of its email distribution service server systems had been accessed without authorization, resulting in the external extraction of email addresses held by client companies. According to the announcement on the 2nd, investigations as of that date confirmed the unauthorized extraction of approximately 77 million email addresses.
Unauthorized access was confirmed on the 28th of last month, and the affected server has already been disconnected from the network. The cause was attributed to the exploitation of a web server vulnerability by a third party. Okinawa Prefecture has also disclosed the potential leak of member email addresses through the same service used in its contracted operations.
Currently, incidents of personal information leaks, including email addresses, are occurring in succession. According to MM Research Institute, approximately 376 million pieces of personal information were leaked domestically by the end of last month in 2026. This represents a scale about 7.6 times larger than the 49.53 million cases recorded in 2025.
Reference: Zaif Announcement, MM Research Institute
Image: Shutterstock
Binance Discloses Attack Vector in $6.3B Breach Involving Fake Job Interviews and Internal AI Tools
