MUFG and Nomura shareholders’ email addresses leaked in Arara data breach
According to Nikkei, Mitsubishi UFJ Financial Group and Nomura Holdings announced on November 11 that some shareholders’ email addresses were leaked because the mail delivery system of external service provider Arara was accessed without authorization.
MUFG and Nomura had entrusted the relevant business to e-gift company Gift Pad, which uses Arara’s system. In MUFG’s case, the email addresses of about 20,000 shareholders who received e-gift prize emails in July were leaked; in Nomura’s case, about 13,500 shareholder email addresses were leaked.
The two companies said the leaked information did not include other data such as shareholder numbers, and their own systems were not affected. The Cabinet Office also announced on the same day that about 60,000 email addresses of its email newsletter registrants were leaked in the same incident.
Arara is a subsidiary of Paycloud Holdings, and it had previously reported that its mail service was attacked, with the affected scope expanding to tens of millions of email addresses.
Original source:
Title: Mitsubishi UFJ and Nomura, some shareholders’ email addresses leaked in unauthorized access to Arara Published by: Nikkei Date published: 2026-11-11 URL: https://www.nikkei.com/article/DGXZQOUB118EO0R11C26A1000000/ Source nature: news report Verification status: Read in this report; consistent with the companies’ disclosures and the background of the Arara incident Supporting content: Supports the facts of the two companies’ shareholder email leakage quantities and the outsourcing relationship
ABAB AI Insight
Shareholder email addresses were exposed through multiple layers of outsourcing (company → gift service provider → mail platform), showing supply chain security risks. The leak was limited to email addresses and did not involve core account information.
The Arara incident has had a broad impact, affecting multiple companies and government agencies, and attackers had also used the system to send phishing emails.
Financial institutions need to strengthen third-party vendor audits and data minimization practices to reduce the risk of similar indirect leaks.
ABAB News · Cognitive Laws
Shareholder email addresses were leaked through outsourced email services.
The leak was limited to email addresses and did not include sensitive information such as shareholder numbers.
The large-scale Arara leak continues to affect multiple institutions.