Teollimi

Internet Initiative Japan (IIJ) data breach

Internet Initiative Japan (IIJ) announced a data breach on Nov 4, 2026 affecting about 983,458 email addresses, exposing email addresses and names. It happened through a vendor (Arara (email delivery service)). No settlement or compensation has been announced.

Was I affected?

Current and former IIJmio customers, including JAL Mobile powered by IIJmio and BIC SIM powered by IIJ subscribers. IIJ emailed the 1,213 people whose names leaked on November 11 and is notifying the rest in turn.

Internet Initiative Japan (IIJ) breach facts
AnnouncedNov 4, 2026
When it happenedIntrusion at email vendor Arara, which confirmed that data was taken from the environment used for IIJmio emails
CountryJapan
Email addresses exposed983,458
Data exposedEmail addresses and Names
Through a vendorArara (email delivery service)
StatusConfirmed by the company or a regulator filing

What happened

Internet Initiative Japan (IIJ) said on November 4, 2026 that 983,458 email addresses of customers of its IIJmio mobile service leaked after an outsider broke into the email delivery service of Arara, its email contractor. The addresses include former customers and subscribers to JAL Mobile and BIC SIM, which run on IIJmio. In an update on November 11, IIJ said names also leaked for 1,213 of those customers. Card data was not shared with Arara and was not involved.

What should I do?

  1. Be wary of emails claiming to come from IIJ, IIJmio or Arara, and don't open their links or attachments.
  2. Delete emails from news@arara.com or with subjects asking you to confirm your usage or statement.
  3. Don't enter your ID, password or card details from an email link; check your account on the IIJmio member site instead.

Know someone who uses Internet Initiative Japan (IIJ)? Share this

XFacebookWhatsAppRedditThreadsBlueskyEmail

More data breaches in Japan →

Check the other services you use →

Sources