Information leakage and service suspension caused by unauthorised access to “アララメッセージ,” provided by a consolidated subsidiary of the Company (Second Report)
アララ株式会社 (a consolidated subsidiary of the filing company)
アララメッセージ (email delivery service), 97 servers in the environments of contracted companies, and the previously reported shared environment
A vulnerability in the web server and issues in the system environment
Company response
All アララメッセージ (email delivery service) operations suspended. Suspension completed at 19:53 on 31 October 2026
Undecided
An investigation is under way in cooperation with external specialist organisations. Establishment of a third-party committee or special investigation committee: Not disclosed
Comprehensive changes to authentication credentials, system reconstruction, and enhanced monitoring
Fiscal year ending August 2027
The impact of this matter on the fiscal year ending August 2027 is currently under review. The Company will promptly disclose any matters requiring disclosure.
Related procedures
Reports to the Personal Information Protection Commission, the police and JIPDEC
Personal Information Protection Commission, the police, and Japan Institute for Promotion of Digital Economy and Community (JIPDEC)
The Company will investigate the access route, the time of commencement and the scope of the impact, make comprehensive changes to authentication credentials, reconstruct the system, and strengthen its monitoring framework. The resumption of the service will be decided after identifying the access route, making comprehensive changes to authentication credentials, confirming system security and taking other measures.
The results of the detailed investigation will be disclosed in the third report. Any newly identified facts will be disclosed promptly.
| Item | Details |
|---|---|
| Event name | Information leakage and service suspension caused by unauthorised access to “アララメッセージ,” provided by a consolidated subsidiary of the Company (Second Report) |
| Date of occurrence | 27 to 31 October 2026 (varies by category) |
| Date recognized / date notice received | 31 October 2026 (the exfiltration through this service was identified during the investigation) |
| Subject Entity | アララ株式会社 (a consolidated subsidiary of the filing company) |
| Target Locations / Products | アララメッセージ (email delivery service), 97 servers in the environments of contracted companies, and the previously reported shared environment |
| Cause | A vulnerability in the web server and issues in the system environment |
| Accounting period in which recognized | Fiscal year ending August 2027 |
| Impact on Earnings Forecast | The impact of this matter on the fiscal year ending August 2027 is currently under review. The Company will promptly disclose any matters requiring disclosure. |
| Type of litigation or proceeding | Reports to the Personal Information Protection Commission, the police and JIPDEC |
| Court or authority | Personal Information Protection Commission, the police, and Japan Institute for Promotion of Digital Economy and Community (JIPDEC) |
| Suspended operations | All アララメッセージ (email delivery service) operations suspended. Suspension completed at 19:53 on 31 October 2026 |
| Scheduled resumption date | Undecided |
| Investigation structure | An investigation is under way in cooperation with external specialist organisations. Establishment of a third-party committee or special investigation committee: Not disclosed |
| Measures to prevent recurrence | Comprehensive changes to authentication credentials, system reconstruction, and enhanced monitoring |
| Outlook | The Company will investigate the access route, the time of commencement and the scope of the impact, make comprehensive changes to authentication credentials, reconstruct the system, and strengthen its monitoring framework. The resumption of the service will be decided after identifying the access route, making comprehensive changes to authentication credentials, confirming system security and taking other measures. |
| Planned follow-up disclosure | The results of the detailed investigation will be disclosed in the third report. Any newly identified facts will be disclosed promptly. |
Items this document does not state (9)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.In addition to a vulnerability in the web server, issues in the system environment also contributed to the incident.