Fanplus (with Tixplus) data breach
Fanplus (with Tixplus) announced a data breach on Nov 2, 2026 affecting about 4.4 million email addresses, exposing email addresses. It happened through a vendor (Arara (email delivery service)). No settlement or compensation has been announced.
Was I affected?
People registered with the companies' shared "Plus member ID" and others who received emails from Fanplus or Tixplus services through Arara.
| Announced | Nov 2, 2026 |
|---|---|
| When it happened | Intrusion at email vendor Arara (Arara Message), announced by Fanplus on November 2, 2026 |
| Country | Japan |
| Email addresses exposed | 4.4 million |
| Data exposed | Email addresses |
| Through a vendor | Arara (email delivery service) |
| Status | Confirmed by the company or a regulator filing |
What happened
Fanplus and Tixplus, Japanese companies behind artist fan club and electronic ticketing services, said on November 2, 2026 that email addresses leaked after an outsider broke into "Arara Message", the Arara email service they used. In a second notice on November 6 they put the leak at about 4.43 million email addresses, a current estimate from matching Arara's data against their own. No other information is known to have leaked, their own service systems were not breached, and they have stopped using Arara Message.
What should I do?
- Be wary of emails claiming to come from Fanplus, Tixplus, an artist's fan club or Arara, and don't open their links or attachments.
- Don't enter your ID, password or card details on a page reached from an email about ticket wins or payments.
- If you already did, change the password and call your card issuer.
Check the other services you use →
Sources
- アララ株式会社で発生した不正アクセスに伴うメールアドレスの漏えいについて（第二報） (Leak of email addresses following unauthorized access at Arara (second notice)) · Fanplus and Tixplus (in Japanese) · official
- アララ株式会社で発生した不正アクセスに伴うメールアドレスの漏えいについて (Leak of email addresses following unauthorized access at Arara) · Fanplus and Tixplus (in Japanese) · official