Chobirich data breach
Chobirich announced a data breach on Nov 4, 2026 affecting about 1.3 million email addresses, exposing email addresses and dates of birth. It happened through a vendor (Arara (email delivery service)). No settlement or compensation has been announced.
Was I affected?
Chobirich members whose email addresses the company passed to Arara for its member emails.
| Announced | Nov 4, 2026 |
|---|---|
| When it happened | Intrusion at email vendor Arara; Arara told Chobirich on November 3, 2026 that email addresses had leaked |
| Country | Japan |
| Email addresses exposed | 1.3 million |
| Data exposed | Email addresses, Dates of birth and Other details |
| Through a vendor | Arara (email delivery service) |
| Status | Confirmed by the company or a regulator filing |
What happened
Chobirich, which runs the Japanese points rewards site of the same name, said on November 4, 2026 that 1,348,525 member email addresses leaked after an outsider broke into the email delivery service of Arara, its email contractor. The figure counts addresses, not members. Member numbers, nicknames, dates of birth, gender, prefecture and point balances may also have been taken. Names, phone numbers, passwords and bank account details were not held by Arara.
What should I do?
- Be wary of emails claiming to come from Chobirich or Arara, and don't open their links.
- Chobirich says it never asks for passwords by email; sign in only through the official site or app.
- Change your Chobirich password if you reuse it elsewhere or it is easy to guess, and watch your point balance.
Check the other services you use →
Sources
- 委託先メール配信サービスへの不正アクセスに関するお詫びとお知らせ (Apology and notice about unauthorized access at our email delivery contractor) · Chobirich (in Japanese) · official