Image Credit: Shutterstock
- Japanese crypto exchange Zaif confirmed an email address leak affecting hundreds of thousands of users.
- The exposed data involved only email addresses while passwords and personal details remained excluded.
- Zaif urged customers to watch for phishing while reporting no unauthorized logins or asset losses.
Zaif Confirms Email Leak, Warns Customers About Phishing
Japanese crypto exchange Zaif confirmed on Nov. 4 that 380,536 unique customer email addresses leaked following unauthorized access to third-party email provider Arara. The exchange warned customers about phishing but had identified no related unauthorized logins or asset losses.
Email Addresses Exposed, Passwords Excluded
Zaif cleared that the exposed information contained email addresses only. Names, addresses, telephone numbers, transaction information, passwords, and email contents were not included.
The exchange had found no unauthorized access to its own systems. An email address alone cannot unlock a customer account, but it can give scammers a destination for messages designed to steal passwords or authentication codes.
The count represents unique addresses, rather than a confirmed number of current customers. Zaif cleared that the historical registrations might be included and was checking the breakdown.
Provider Breach Disrupts Email Delivery
Arara suspended its entire Arara Message service on Oct. 31 after discovering that unauthorized access extended across additional servers. Its Nov. 2 update recorded approximately 77 million email addresses taken from client-server environments, with the count still under investigation. That provider-wide estimate is separate from Zaif’s confirmed count.
For the initially disclosed breach, Arara identified a web-server vulnerability and problems in its system environment. External specialists were investigating the wider intrusion’s route and scope while the company worked on credential changes, rebuilding systems and stronger monitoring.
Arara’s restarting would depend on identifying the intrusion route and confirming system safety. It had not set a reopening date, leaving clients dependent on alternative communication channels.
Customers Directed to Official Notices
Zaif suspended announcement-email delivery because of Arara’s shutdown. Customers were directed to its website and official X account for updates, with individual notifications planned after email delivery resumed.
The exchange urged customers not to open suspicious attachments, follow unexpected links or enter passwords and two-factor codes into unfamiliar login pages. It also recommended that customers using email authentication consider switching to an authenticator app.
Zaif had reported the incident to relevant authorities. It would review what information it shared with contractors and their security arrangements, including whether to change providers.
