Mitsui Fudosan said on 5 November that a mail-delivery system from Arara, used by a contractor that sends the &BIZ newsletter for office-tenant employees, had been accessed by a third party and that some member information had leaked [1]. The leaked data are 133,323 email addresses registered as &BIZ newsletter destinations; the company said that system does not handle names or other personal data, which were not found to have leaked. Arara’s mail servers were accessed from 27 to 31 October, the contractor first reported on 2 November, and an additional report on 4 November confirmed about 130,000 addresses. Newsletter delivery has been paused, and the company said it had not confirmed specific secondary harm [1]. It asked members who receive suspicious email impersonating Mitsui Fudosan, its group companies or Arara not to open URLs or attachments in the message, and not to enter or reply with personal data [1].
MediumMonitoringOfficially confirmed
Mitsui Fudosan says a vendor mail system leak exposed 133,323 &BIZ newsletter email addresses
1 min read
- Disclosed
- Nov 5, 2026
- Occurred
- Oct 27, 2026
- Published
- Nov 12, 2026
- Last updated
- Nov 12, 2026
- Scale
- 133,323 records[1]
- CVSS basis
- Our assessment
- Attack vector
- Third-party compromise
- Actor type
- Unknown
- Motivation
- Unknown
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Professional services
What to do nowOur advice
- If you receive suspicious email impersonating Mitsui Fudosan, its group companies or Arara, do not open URLs or attachments, and do not enter or reply with personal data [1].
- &BIZ newsletter delivery is paused; rely only on official website notices about any resumption [1].
- Questions can be sent to the Mitsui Fudosan &BIZ office at andbiz2@mitsuifudosan.co.jp [1].
Timeline
Technical details
Remediation
Vendor guidance
- 1Do not open links in messages impersonating Mitsui Fudosan or Arara mitigate[1]
If you receive a suspicious message impersonating the company, its group or Arara, do not open URLs or attachments or enter personal data.
References
Official / primary1
- [1]三井不動産株式会社2026-11-05Accessed 2026-11-12Snapshot 2026-11-12 sha256 e42d3eb69c3d
“URL へのアクセスや添付ファイルの開封、個人情報等の入力・回答を行わないよう、十分にご注意ください”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.