ARTPASS (Inventit) data breach
ARTPASS (Inventit) announced a data breach on Nov 4, 2026 affecting about 986,434 email addresses, exposing email addresses. It happened through a vendor (Arara (email delivery service)). No settlement or compensation has been announced.
Was I affected?
People subscribed to the ARTPASS email newsletter. ARTPASS is emailing those affected.
| Announced | Nov 4, 2026 |
|---|---|
| When it happened | Intrusion at email vendor Arara; Arara first said the ARTPASS environment was unaffected, then reported the leak |
| Country | Japan |
| Email addresses exposed | 986,434 |
| Data exposed | Email addresses |
| Through a vendor | Arara (email delivery service) |
| Status | Confirmed by the company or a regulator filing |
What happened
Inventit, which runs ARTPASS, a Japanese ticketing service for museums and exhibitions, said on November 4, 2026 that newsletter subscribers' email addresses leaked after an outsider broke into Arara, the company that sent its newsletter. In an update on November 10 it put the count at 986,434 addresses. Only email addresses were taken; names, home addresses, phone numbers, login passwords and card data were not, and the ticket sales system was not affected. ARTPASS began notifying affected people individually on November 10.
What should I do?
- Be wary of emails claiming to come from ARTPASS, Inventit or Arara, and delete them without opening links or attachments or replying.
- Check exhibition tickets on the official ARTPASS site rather than through email links.
- Consider tightening spam filtering on the address you registered if scam emails increase.
Check the other services you use →
Sources
- 【重要】メールマガジン配信業務委託先への不正アクセスに関するお詫びとお知らせ（11月10日更新） ([Important] Apology and notice about unauthorized access at our newsletter delivery contractor (updated November 10)) · ARTPASS (Inventit) (in Japanese) · official