GMO Payment Service announced that unauthorized access to its contractor's アララメッセージ service may have resulted in up to 106,997 customer records being disclosed externally. Up to 5,771 of these records included names, billing amounts, stores of purchase and product information.
GMO Payment Service Co., Ltd. announced on 5 November 2026 that customer information had been disclosed externally following unauthorized access to 「アララメッセージ」, an email delivery service provided by its contractor アララ株式会社. Up to 106,997 records were affected, of which up to 5,771 included names, billing amounts, stores of purchase or use, product information and other billing details.
The unauthorized access was confirmed at the external email delivery service, and it was explained that GMO Payment Service's own systems and services were not affected. Emails had been delivered by Martial Arts, the law firm engaged by the contractor, meaning that the route of the data leak extended to GMO's external business partner.
According to a separate announcement by アララ, approximately 77 million email addresses across アララ may have been taken externally, and up to approximately 7.13 million suspicious emails may have been sent. These figures are provisional and remain subject to the completion of the investigation.
This incident involved an information leak through アララ, a separate service within the GMO Group, and does not directly mean that GMO Payment Service's own payment platform was accessed without authorization. Information is expected to be provided to affected individuals through individual notifications.