Overview
Affected fields included email addresses, member IDs/numbers, names, sex, dates of birth, registration/login dates, contacts and ticket purchase/use details. Passwords and credit cards were not entrusted to Arara and were excluded. This is separate from the May satsuki incident. A November 6 addition confirms all affected people were emailed by 19:00 JST on November 5, superseding older text saying identification was pending.
Timeline
- Occurred
- Discovered
- Disclosed
Vendor report received; email delivery stopped and credentials invalidated.
Member-record exposure disclosed.
Update confirms notifications completed by 19:00 JST on November 5.
Organization response
After receiving the report on November 2, the company stopped email delivery and invalidated console passwords/API keys. It disclosed the event November 3 and notified affected individuals by November 5.
What you can do
Check notices through the organisation’s genuine contact channels. Do not enter credentials or payment details through links in unexpected messages.
Sources
- アララメッセージ委託先事件と11月6日更新アソビュー · 2026-11-09