Asoview, which operates the leisure and entertainment booking service “Asoview!,” announced on November 3 that unauthorized access to a contracted email delivery service resulted in the leak of 15,821,184 member records. The breach extends beyond names and contact details to include usage histories such as ticket purchase dates and times and the names of facilities used — a leak of a scale that could allow members’ behavioral patterns to be inferred.
The cause of the leak was unauthorized access to “Arara Message,” a service provided by Arara (Minato Ward, Tokyo), to which Asoview outsources email delivery. Asoview explained that “this incident stems from unauthorized access to a service provided by Arara, not our own system,” and said no intrusion into its own systems has been confirmed.
The leaked data covers members to whom emails were delivered through the service. The items are wide-ranging: email addresses, member IDs and member numbers, names, gender, dates of birth, membership registration dates, last login dates, phone numbers, postal codes and residential regions. In addition, ticket purchase and usage histories — including purchase dates and times, ticket types, number of tickets purchased, facility names, usage dates and times, number of participants and whether cancellations occurred — were also affected.
Passwords and credit card information, meanwhile, are not stored with Arara and were not leaked, according to the company. As of the announcement, no damage from malicious use of the leaked information had been confirmed.
The sequence of events was as follows. On November 2, Asoview received a report of the data leak from Arara and suspended all email deliveries using the service. It also invalidated authentication credentials such as administrative screen passwords and API keys used for system integration. The following day, November 3, it received a report on the items and volume of leaked information. It plans to file preliminary reports with Japan’s Personal Information Protection Commission and the Japan Information Economy and Society Promotion Association (JIPDEC) on November 3.
However, Asoview has not yet determined which members the leaked email addresses belong to. Arara is still investigating the affected individuals, and Asoview plans to receive information on those affected from Arara, cross-check it against its own member data and then contact the relevant members individually.
Until the affected individuals are identified, Asoview is urging all members to be wary of suspicious emails, text messages and phone calls. This is because contact seeking personal information or money under the pretext of refunds, cancellations, prize winnings or identity verification is anticipated, and the company is asking members not to open URLs contained in unexpected emails or text messages. It says it will never ask for passwords or credit card information by email, text message or phone. The dedicated inquiry line is 0120-30-3521, open from 10 a.m. to 7 p.m., including weekends and holidays.
The Arara incident is broad in scope. The company disclosed the unauthorized access and service suspension on October 29, and in a second report on November 2 said the impact extended to as many as roughly 380 contracted companies. It is not clear at this point what proportion of the overall total Asoview’s 15.82 million records represent.
ItemDetailsRecords leaked15,821,184CauseUnauthorized access to contractor’s “Arara Message”Leaked itemsEmail addresses, member IDs and member numbers, names, gender, dates of birth, membership registration dates, last login dates, phone numbers, postal codes, residential regions, ticket purchase and usage historiesInformation not leakedPasswords, credit card informationIdentification of affected individualsNot yet completed (under investigation by Arara)Confirmed damageNo malicious use confirmed as of announcement
Note: Based on Asoview’s November 3 announcement and Arara’s disclosures.
The incident has once again highlighted the risks inherent in the arrangement whereby companies entrust customer data to external cloud services to improve operational efficiency. It demonstrates that even when a company’s own system defenses are sound, a breach at a contractor can result in the leak of massive amounts of member information. Email delivery platforms are easily linked to purchase histories in addition to names and contact details, a characteristic that means the impact of a leak can extend beyond personal information to behavioral analysis and targeted attacks.
In the leisure and ticket booking sector, where the scale of a member base is itself a source of competitive strength, delays in restoring trust can affect business operations. Asoview is being pressed to speed up the identification and individual notification of affected individuals while also verifying its contractor management framework to prevent recurrence. Its approach — whether to use multiple contractors or to minimize the data delivered — could determine future customer attrition.
The focus now is whether the disclosure of the data leak will affect partner companies and advertisers that use the company’s member base. Depending on the contents of the report to Japan’s Personal Information Protection Commission and the progress of Arara’s investigation, the incident could lead to a review of outsourcing contracts and stricter criteria across the industry for selecting third-party services.