Présentation
Affected fields included email addresses, member IDs/numbers, names, sex, dates of birth, registration/login dates, contacts and ticket purchase/use details. Passwords and credit cards were not entrusted to Arara and were excluded. This is separate from the May satsuki incident. A November 6 addition confirms all affected people were emailed by 19:00 JST on November 5, superseding older text saying identification was pending.
Chronologie
- Survenue
- Découverte
- Divulgation
Vendor report received; email delivery stopped and credentials invalidated.
Member-record exposure disclosed.
Update confirms notifications completed by 19:00 JST on November 5.
Réponse de l’organisation
After receiving the report on November 2, the company stopped email delivery and invalidated console passwords/API keys. It disclosed the event November 3 and notified affected individuals by November 5.
Que faire ?
Check notices through the organisation’s genuine contact channels. Do not enter credentials or payment details through links in unexpected messages.
Sources
- アララメッセージ委託先事件と11月6日更新アソビュー · 2026-11-09