Kakaku.com data breach
Kakaku.com announced a data breach on Nov 5, 2026 involving up to 5.7 million records (duplicates possible), exposing email addresses and dates of birth. It happened through a vendor (Arara (email delivery service)). No settlement or compensation has been announced.
Was I affected?
Users of Tabelog, Kakaku.com, Smaity, Kyujin Box and icotto whose email addresses Kakaku.com passed to Arara to send them emails. Kakaku.com says it will contact affected users.
| Announced | Nov 5, 2026 |
|---|---|
| When it happened | Intrusion at email vendor Arara, whose email delivery service Kakaku.com used |
| Country | Japan |
| Records exposed (may include duplicates) | 5.7 million |
| Data exposed | Email addresses, Dates of birth and Other details |
| Through a vendor | Arara (email delivery service) |
| Status | Confirmed by the company or a regulator filing |
What happened
Kakaku.com, which runs the Japanese restaurant review site Tabelog and the price comparison site Kakaku.com, said on November 5, 2026 that about 5.7 million personal records leaked after an outsider broke into the email delivery service of Arara, its email contractor. The leak covers about 4.19 million Tabelog records, about 1.37 million Kakaku.com records, about 140,000 for the real estate site Smaity, 142 for the job site Kyujin Box and 4 for icotto, all with email addresses. About 650,000 of the Kakaku.com records also include birthday and gender. Email contents were not involved and no resulting harm had been confirmed. Kakaku.com will not go back to Arara and is moving its emails to another provider.
What should I do?
- Be wary of emails claiming to come from Tabelog, Kakaku.com or Arara, and don't open links or attachments you weren't expecting.
- Kakaku.com says it never asks for passwords or card details by email; delete any message that does.
- Sign in through the official apps or a bookmarked site rather than links in emails.
- Consider filtering or changing the email address registered with these services if scam emails increase.
How Korea fines a breach this size
For comparison, Korea's privacy regulator fined Louis Vuitton Korea ₩21.4 billion (about US$14M) in February 2026 over a breach of 3.6 million people. Korean law fines the security failure itself, not only misuse of the data.
Check the other services you use →
Sources
- 業務委託先への不正アクセスに伴う当社サービスをご利用いただいているお客さまのメールアドレス漏えいについて (Leak of email addresses of customers using our services caused by unauthorized access at a contractor) · Kakaku.com (in Japanese) · official
- カカクコム、個人情報約570万件流出 アララへの不正アクセスで · Nikkei (in Japanese) · news