ICHI Briefs & Podcasts · ICHI Daily · five-minute podcast

ICHI Global Five Minute Cyber Rundown

ICHI Daily · Published November 3, 2026 · 5 min listen

Arara Message breach grows to about 77 million email addresses across up to 380 companies, and the service itself was used to send 7.13 million phishing emails; Synology warns of C3RB3R ransomware on unpatched NAS devices; Sega's arcade networks remain offline and Suntory discloses a cloud breach affecting around 100,000 people.

Listen to this episode

MP3, 2.3 MB · · the full transcript is below.

Show notes

ICHI Global Five Minute Cyber Rundown — Tuesday, November 3, 2026

Today's theme is borrowed trust: a Japanese email delivery service breached at scale and then used to send phishing, ransomware working through a two-year-old uninstalled patch, and a national arcade network still offline.

Most important development — Arara Message breach grows to ~77 million addresses (second report, November 2)

Paycloud Holdings' second report (November 2) on its subsidiary Arara's Arara Message email delivery service is far larger than the October 29 first report (3.01 million addresses). Between October 28–31, an intruder moved from an Arara Message server into 97 servers holding client-company mailing lists, copying database contents; data extraction is timed to 01:36 October 29 – 02:22 October 30 (Japan time). About 77 million email addresses were taken or may have been taken, linked to up to about 380 client companies. The figure is not de-duplicated, is still being checked, and may change. Depending on the client, records also held names, gender, dates of birth, phone numbers, membership numbers, and addresses. Arara says it holds no credit card numbers.

Weaponization: from October 28–30, attackers used two Arara environments to send up to about 7.13 million phishing emails posing as a credit card company, from news@arara.com, to addresses the attacker brought in from outside (so the phishing recipients are not a measure of the stolen lists). A phishing message sent through a real, trusted delivery platform inherits that platform's sending reputation. Arara cancelled the misused credentials, cut server connections, and suspended all Arara Message and ASP repica services on October 31 (including admin panel and API). Restart is conditioned on finding the entry point, changing all credentials, and confirming safety; clients will be asked to reset admin passwords and API keys. Arara first attributed entry to a web server vulnerability; the second report adds problems in the system environment. A third report with revised counts and earnings impact is promised.

Pattern, not one-off: per Japan Cyber Watch, Arara is the fifth Japanese email delivery service breached in October 2026 — after Arcadia (local-government disaster alerts), Yumil Link / Cuenote (now ~51.63 million records from 49 client systems), Blastmail (a Rakus subsidiary; all customers plus delivery lists of 345 clients), and Y-mail (Igreks). Three of the four earlier services were also used to send phishing. Separately, Osaka Gas reported on November 2 that an external email distribution service used for its meal delivery service was breached, leaking over 30,000 customer email addresses (MBS News reporting).

Ransomware — Synology warns of C3RB3R attacks on outdated NAS devices

Synology's security notice (October 29) says threat actors are exploiting a vulnerability patched in December 2024 against devices running outdated DiskStation Manager (DSM) versions, encrypting data for ransom. BleepingComputer's November 2 report identifies the payload as C3RB3R ransomware: victims find files renamed with the .L0CK3D extension and a note (read-me3.txt) directing them to a dark-web portal to buy the "C3rb3r Decryptor"; forum reporting relayed by BleepingComputer says there is no known decryptor. Synology pointed to advisory Synology-SA-24:20 (which includes CVE-2024-10441, arbitrary code execution; CVE-2024-50629, file read; CVE-2024-10445, file write) but has not publicly identified the exact vulnerability used in the current attacks — do not attribute every infection to a specific CVE. Minimum fixed builds include DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8 or above. Shadowserver tracks more than 380,000 internet-exposed Synology devices — exposure, not a count of vulnerable or infected machines. Guidance: update DSM immediately, enable automatic updates, and block internet access to the DSM management interface. Synology rarely issues such warnings; its last comparable alert was August 2019 (eCh0raix brute-force campaign).

Incidents — Sega arcade networks offline; Suntory cloud breach

Sega / Sega Fave (ALL.net and Aime): a third party gained unauthorized access to the ALL.net arcade network and the Aime NFC card service; all related services have been offline since November 1, 15:00 JST, taking down online play, leaderboards, and save data for major titles including Bandai Namco's Taiko no Tatsujin and Sega's Initial D: The Arcade; some arcades are running machines in limited offline mode. Sega Fave's November 2 update says the investigation is expected to take some time; no return date. Sega states no customer or business partner data was breached and payment information was not stored on the affected servers — an early company statement, not a final finding. The same service was taken down for several days in late October over the PHP exploit and had been reopened Japan-only.

Suntory Holdings: on November 2, Suntory disclosed unauthorized access to an external cloud service it uses, with files containing personal information downloaded. Affected: about 90,000 group and partner-company employees, 7,323 corporate-activity program registrants (as of end-2023), and 7,173 applicants to its 2026 graduate recruitment — around 100,000 people in total, including names, email addresses, and phone numbers; no payment information. Suntory says the access was blocked and no misuse has been confirmed; notifications are under way and the investigation continues.

Threat-environment context — Clusit H1 2026

Clusit's updated 2026 report (released in Verona, reported by ANSA on November 3) logged 4,911 serious incidents worldwide in January–June 2026 — up 71% on H1 2025 and 105% on the previous six months, averaging 819 incidents a month; the half-year total already equals 93% of all incidents recorded in 2025. Italy bucked the trend on count (245, down from 280) but not severity. The report flags the first indications of "agentic hacking" — AI agents carrying out attack tasks with growing independence (reported as early indications, not an established shift).

Defensive implications

Treat email delivery vendors as critical infrastructure: inventory what lists they hold, minimize shared data, and be able to rotate API keys and admin credentials immediately — Arara will require exactly that of its clients.
Do not rely on sender-authentication checks alone: phishing sent through a compromised legitimate platform passes the checks that catch fresh attacker domains. Warn customers early and specifically.
Patch storage: update Synology DSM, enable automatic updates, remove the management interface from the internet, and verify backups are offline/immutable — NAS devices holding backups are a direct ransomware target.
Expect follow-on phishing and credential abuse aimed at people named in the Arara, Suntory, and Osaka Gas disclosures; brief support desks on impersonation of Arara and its client companies.

ICHI note

ICHI.global's production methodology remains VECTORS model v7.1 (seven scored dimensions; Outages informational), per the methodology page updated October 13, 2026. No live composite score is cited in this episode because the live score did not render in the production-time check; no methodology change is announced.

Transcript

Akari: The daily cyber rundown, brought to you by ICHI.global. I'm Akari, and this is Tuesday, November third, twenty twenty-six. Today's theme is trusted infrastructure turned against its own users. A Japanese email delivery service was breached at enormous scale and then used to send millions of phishing emails, ransomware is encrypting storage devices that skipped a patch from twenty twenty-four, and an arcade network in Japan is still offline after unauthorized access. The backdrop is grim. Italy's Clusit association counts four thousand, nine hundred eleven serious incidents worldwide in the first half of this year, up seventy-one percent on last year, and already ninety-three percent of the whole of twenty twenty-five.

Akari: The most important development is the second, far larger report on the Arara Message breach, published on Monday by its parent, Paycloud Holdings. Arara now says attackers moved from one of its servers into ninety-seven servers holding client mailing lists between October twenty-eighth and thirty-first, and took, or may have taken, about seventy-seven million email addresses linked to as many as three hundred eighty companies. The count is not de-duplicated and is still being checked, and depending on the client, the records also held names, dates of birth, phone numbers, and addresses. Arara says it holds no credit card numbers. Worse, the attackers used the service itself, between October twenty-eighth and thirtieth, to send up to seven point one three million emails posing as a credit card company, to addresses they brought in from outside. A phishing message sent through a real, trusted delivery platform is exactly the kind that sails past filters. Arara shut the whole service down on October thirty-first, and says it restarts only once the entry point is found and every credential is changed. And this was not an isolated case. Arara is the fifth Japanese email delivery service breached in October, after Arcadia, Yumil Link, Blastmail, and Y Mail, and several of those were also used to send phishing.

Akari: Next, storage. Synology is warning that attackers are encrypting network attached storage devices with ransomware called C three R B three R, by exploiting a flaw the company patched back in December twenty twenty-four. Victims find their files renamed and a ransom note offering a decryptor for sale. Synology has not publicly named the exact flaw being used, so do not assume a single C V E tells the whole story. More than three hundred eighty thousand Synology devices are exposed to the internet by Shadowserver's count, though that is a count of exposure, not of vulnerable or infected machines. If you run one, update DiskStation Manager now, turn on automatic updates, and take the management interface off the open internet. A two year old patch, uninstalled, is doing the work of a zero-day here.

Akari: Two more confirmed incidents from Japan. Sega's arcade networks, ALL dot net and Aime, have been offline since November first after a third party gained unauthorized access, and Sega Fave said on November second that its investigation will take some time, with no return date yet. Sega says no customer or business partner data was breached, and that payment information was not stored on the affected servers. Treat that as the company's early statement, not a final finding. Separately, Suntory says unauthorized access to an external cloud service exposed personal information for around one hundred thousand people, including about ninety thousand group and contractor employees and more than seven thousand graduate recruitment applicants. Suntory says the access has been blocked and it has confirmed no misuse so far.

Akari: So the defensive list writes itself. Treat any vendor that sends mail in your name as critical infrastructure. Know what lists it holds, cut what it does not need, and be ready to rotate A P I keys and admin passwords fast, because phishing sent from a legitimate platform will not be stopped by address checks alone. Warn your customers early and specifically, the way Arara's clients now have to. Patch the boring devices, especially storage that holds your backups. And watch for follow-on phishing aimed at anyone named in these disclosures.

Akari: That is the takeaway. The most damaging access today is often borrowed trust, a vendor's servers, a vendor's sending reputation, a device everyone forgot to update. You will find the underlying evidence for every story in today's rundown at ICHI.global. I'm Akari. Stay safe, and I will see you tomorrow.

Sources

TSN Media — Arara Data Breach Grows to About 77m Email Addresses tsnmedia.org
Japan Cyber Watch — Four Email Delivery Services Breached in a Month: Why Japan's Bulk Mail Vendors Became a Target (updated November 2 with Arara) japancyberwatch.com
Qazinform (Jiji Press) — Japan's Arara Message hit by cyberattack, exposing 77 million email addresses qazinform.com
BleepingComputer — Synology warns customers of ongoing C3RB3R ransomware attacks www.bleepingcomputer.com
Kotaku — Japanese Arcade Machines Have Been Taken Down By A Major Hack Of Sega's Services kotaku.com
Independent Press (ANSA) — Record Cyber Incidents Surge Worldwide As AI Threat Looms (Clusit H1 2026 report) independentpress.cc

All ICHI Daily episodes · ICHI Briefs & Podcasts

ICHI Daily and ICHI Weekly are editorial commentary on ICHI’s evidence. They never change the VECTORS score, incident evidence classifications or intelligence rankings.

ICHI Briefs & Podcasts · ICHI Daily · ICHI Weekly · Episode calendar · ICHI Perspectives · episodes.json · ICHI dashboard · Methodology