Gakken Holdings data breach

Gakken Holdings announced a data breach on Nov 5, 2026 involving up to 793,060 records (duplicates possible), exposing email addresses. It happened through a vendor (Arara (email delivery service)). No settlement or compensation has been announced.

What happened

Japanese education and publishing group Gakken Holdings said on November 5, 2026 that personal data leaked after an outsider broke into the email delivery service of Arara, its email contractor. In a second notice on November 9 it put the total at 793,060 records across 17 group companies, including Gakken, Kirihara Shoten, Gakken Cocofump and Bunri, mainly email addresses. No sensitive personal data was found to have leaked, card numbers were never linked to Arara, and no resulting harm had been confirmed.

What should I do?

1. Be wary of emails claiming to come from a Gakken group company or Arara, and don't open their links or attachments or reply.
2. Don't enter personal or card details for emails about learning materials, courses or care services; check on each company's official site.
3. Consider tightening spam filtering on the address you registered if scam emails increase.

More data breaches in Japan →

Check the other services you use →