Arara Co., Ltd. is a Tokyo-based Japanese technology company whose services include messaging and data security. Its Arara Message service is used by businesses to distribute email at scale.

On November 2, Arara disclosed that approximately 77 million email addresses were taken or potentially taken following unauthorized access affecting the service.

That does not mean 77 million individual people. Arara says individuals may hold multiple email addresses, and the figure remains under review.

In the same broader cyber incident, part of Arara’s email-distribution service was improperly used between October 28 and October 30 to send up to approximately 7.13 million suspicious emails impersonating a credit card company.

The disclosed sender was news@arara.com.

Actual subject lines included:

「利用内容確認のご依頼」
「ご利用明細確認のご依頼」

One distinction is important. Arara says the recipient addresses used for those messages were brought into the service from outside by the attacker. The disclosure does not establish that the 7.13 million messages were sent to the approximately 77 million exposed addresses.

What it does show is that the same broader incident involved both large-scale information exposure and the misuse of email infrastructure to send millions of suspicious messages.

What happens next

Phishing, impersonation, fraudulent messages, scam calls and social engineering are already happening every day.

Arara itself warned people to watch for communications impersonating Arara or companies using its service across email, SMS, telephone calls and physical mail.

This is where cybersecurity becomes very personal.

People experience it on a phone.

In an email.

In a text message.

During a call.

At work.

At home.

And the old warning signs are becoming less useful.

Japan’s National Cybersecurity Office (NCO) publishes guidance warning that generative AI can produce phishing messages that are difficult to distinguish from legitimate communications. For Japanese users, that means awkward language and obvious mistakes are becoming much less reliable warning signs.

AI can also be used to impersonate people through fabricated voices and video. Japan’s National Police Agency warns that AI can be used to create another person’s voice or video and impersonate them through messages, calls and video communications.

The voice could sound like someone you know. The video could show a familiar face.

Now add real personal information.

Names. Email addresses. Phone numbers. Employers. Addresses. Account details. Other information exposed through data breaches.

Someone knowing those details does not make them legitimate.

But it can make an attack much more believable.

Japan’s Digital Minister made this connection directly on October 6, warning that leaked information can lead to impersonation, fraudulent transfers and scams.

This is what cybersecurity education now has to prepare people for — every day, not only after a breach.

A notice telling people to “be careful of suspicious emails” is not enough.

Organizations need an ongoing program that can reach people at scale, change as threats change, and teach them how to stop, question what they are being asked to do, and verify through another channel before they act.

Japan has started to respond

Japan has already recognized the need for better security education.

The SCS security evaluation system is overseen by the Ministry of Economy, Trade and Industry (METI) and the National Cybersecurity Office (NCO) and operated by Innovation Platform Agency, Japan (IPA).

The SCS requirements are specific.

At ★3, officers, employees, temporary staff and incoming secondees must receive education and training on how to respond to a security incident when they join and at least once every year. IPA gives examples including reporting a targeted email and responding to a malware infection.

At ★4, the framework requires recurring security-awareness education covering areas including preventing malware infection through email and web browsing and handling sensitive information. That education is required for the same groups when they join and at least annually.

Organizations must also review the content of that education at least annually to ensure it reflects the latest security threats.

That is important progress.

The government is also responding to the extraordinary volume of recent incidents.

On October 28, the Personal Information Protection Commission (PPC) reported that unauthorized-access cases reported directly to it between April 1 and October 16 represented an aggregate of approximately 260 million affected-person entries involving personal-data leaks or possible leaks.

That figure is not a count of 260 million unique people and is not a complete national total.

Two days earlier, Prime Minister Sanae Takaichi specifically pointed to growing concern about secondary harm arising from the misuse of leaked information and called for urgent countermeasures.

The problem is not that Japan has failed to recognize the issue.

The problem is that the response is still fragmented and is not yet reaching people continuously, in the places where the attacks actually happen.

SCS is an important step for enterprises. Government agencies are issuing guidance and warnings. Other initiatives address different parts of the problem.

But a person receiving a convincing message on a phone does not experience cybersecurity as a collection of government programs, corporate policies and guidance documents.

They have a decision to make.

Is this real? What should I do?

What needs to happen now

Cybersecurity education needs to move to the front of Japan’s response.

It needs to reach employees at work.

Parents and children at home.

Older people using smartphones.

Students using school-issued educational devices.

Customers of banks, mobile carriers and digital services.

People in large cities and local communities.

And it needs to be available through the devices and services people already use.

At SAYA, this is our mission.

We want practical cybersecurity and digital-safety education across every device and digital experience people use in Japan.

Over the next few weeks, we will announce new SAYA integrations and deployments designed to do exactly that.

But reaching people at scale will take more than SAYA.

We need trusted partners — employers, national and local government, schools, mobile carriers, technology platforms, financial institutions and other organizations that already reach people every day — to help put practical cybersecurity education where people already are.

If your organization can help reach and protect people in Japan, we want to work with you.

On the phone in their hand.

On the tablet at home.

On school-issued educational devices.

Inside the systems they use at work.

Through the mobile carrier they trust.

Inside the platforms and services they use every day.

Security education should not be something people encounter once a year, or only after something has gone wrong.

It should be part of everyday digital life.

SAYA is a digital-safety platform and intelligence engine built around that mission.

We believe practical cybersecurity education should be available wherever people in Japan interact with technology.

Because the attacks against people are already happening.

And the next message is already on its way.

If your organization can help reach and protect people in Japan, contact SAYA at Safety@SayaUniversity.com