GMO Makeshop data breach

GMO Makeshop announced a data breach on Nov 5, 2026 affecting about 12.6 million email addresses, exposing email addresses. It happened through a vendor (Arara (email delivery service)). No settlement or compensation has been announced.

What happened

GMO Makeshop, which runs the Japanese online-store builder makeshop byGMO, said on November 5, 2026 that email addresses leaked after an outsider broke into "Arara Message", the Arara email service behind its Mail Delivery Plus, MakeRepeater byGMO and makeshop CRM byGMO features. In an update on November 9 it put the leak at about 12.6 million addresses for Mail Delivery Plus and MakeRepeater plus about 40,000 for makeshop CRM, including shop owners' own addresses. The addresses are those that shops built on makeshop emailed between July 1 and October 28, 2026; only email addresses were taken, and passwords and card data were not involved. The company says its own systems were not breached.

What should I do?

1. Be wary of unexpected emails that look like they come from an online store you used or from Arara, and don't open their links or attachments.
2. If an email asks for a password or card number, check with the store through its own website instead.
3. Consider tightening spam filtering on the address you gave online stores if scam emails increase.

More data breaches in Japan →

Check the other services you use →