Information leakage and service suspension caused by unauthorized access to “Arara Message,” provided by our consolidated subsidiary (Third Report)
アララ株式会社 (consolidated subsidiary)
Arara Message, Environment B (another cloud environment)
A third party used authentication credentials without authorization to access Environment B and exfiltrated data.
Company response
Provision of the Arara Message service
To be determined. A decision will be made after identifying the intrusion route, fully changing the authentication credentials and confirming security, among other measures.
A detailed investigation is being conducted with the assistance of external experts.
Further strengthening of the information security framework
Fiscal year ending August 2027
The impact on results for the fiscal year ending August 2027 remains under review. The company will promptly disclose any matters that should be disclosed.
Related procedures
Reports and notifications to the Personal Information Protection Commission, the Kanto Regional Telecommunications Bureau of the Ministry of Internal Affairs and Communications, the police and JIPDEC
The Personal Information Protection Commission, the Kanto Regional Telecommunications Bureau of the Ministry of Internal Affairs and Communications, the police, and the Japan Institute for Promotion of Digital Economy and Community (JIPDEC)
The subsidiary will contact individually the companies that used Environment B, and a decision on resuming the service will be made after identifying the intrusion route, fully changing the authentication credentials and confirming security, among other measures.
The company will promptly disclose any matters that should be disclosed regarding the impact on results. An additional report is scheduled to be submitted to the Personal Information Protection Commission, the Kanto Regional Telecommunications Bureau of the Ministry of Internal Affairs and Communications, and JIPDEC on 6 November 2026.
| Item | Details |
|---|---|
| Event name | Information leakage and service suspension caused by unauthorized access to “Arara Message,” provided by our consolidated subsidiary (Third Report) |
| Date of occurrence | From 28 October 2026 through 31 October 2026 |
| Subject Entity | アララ株式会社 (consolidated subsidiary) |
| Target Locations / Products | Arara Message, Environment B (another cloud environment) |
| Cause | A third party used authentication credentials without authorization to access Environment B and exfiltrated data. |
| Accounting period in which recognized | Fiscal year ending August 2027 |
| Impact on Earnings Forecast | The impact on results for the fiscal year ending August 2027 remains under review. The company will promptly disclose any matters that should be disclosed. |
| Type of litigation or proceeding | Reports and notifications to the Personal Information Protection Commission, the Kanto Regional Telecommunications Bureau of the Ministry of Internal Affairs and Communications, the police and JIPDEC |
| Court or authority | The Personal Information Protection Commission, the Kanto Regional Telecommunications Bureau of the Ministry of Internal Affairs and Communications, the police, and the Japan Institute for Promotion of Digital Economy and Community (JIPDEC) |
| Suspended operations | Provision of the Arara Message service |
| Scheduled resumption date | To be determined. A decision will be made after identifying the intrusion route, fully changing the authentication credentials and confirming security, among other measures. |
| Investigation structure | A detailed investigation is being conducted with the assistance of external experts. |
| Measures to prevent recurrence | Further strengthening of the information security framework |
| Outlook | The subsidiary will contact individually the companies that used Environment B, and a decision on resuming the service will be made after identifying the intrusion route, fully changing the authentication credentials and confirming security, among other measures. |
| Planned follow-up disclosure | The company will promptly disclose any matters that should be disclosed regarding the impact on results. An additional report is scheduled to be submitted to the Personal Information Protection Commission, the Kanto Regional Telecommunications Bureau of the Ministry of Internal Affairs and Communications, and JIPDEC on 6 November 2026. |
Items this document does not state (10)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.The investigation was expanded to Environment B, revealing that authentication credentials had been misused during the existing unauthorized access period and that data had been exfiltrated from Environment B.