KEYUCA (Kawajun) data breach
KEYUCA (Kawajun) announced a data breach on Nov 11, 2026 affecting about 1.2 million email addresses, exposing email addresses. It happened through a vendor (Arara (email delivery service)). No settlement or compensation has been announced.
Was I affected?
People who received the KEYUCA online shop email newsletter between July 1 and October 28, 2026. Kawajun plans to email those affected.
| Announced | Nov 11, 2026 |
|---|---|
| When it happened | Intrusion at email vendor Arara (Arara Message); Arara first warned Kawajun on October 28, 2026 and reported the leak on November 7 |
| Country | Japan |
| Email addresses exposed | 1.2 million |
| Data exposed | Email addresses |
| Through a vendor | Arara (email delivery service) |
| Status | Confirmed by the company or a regulator filing |
What happened
Kawajun, which runs the Japanese home goods chain KEYUCA, said on November 11, 2026 that 1,214,183 email addresses leaked after an outsider broke into "Arara Message", the Arara service used to send the KEYUCA online shop newsletter. The addresses belong to people who received the newsletter between July 1 and October 28, 2026, and no other information was taken. Kawajun stopped the newsletter on October 28 and was told of the leak on November 7. A separate breach at a KEYUCA system contractor, announced the same day and affecting up to 530 customers, is a different incident.
What should I do?
- Be wary of emails claiming to come from KEYUCA, Kawajun or Arara, and don't open their links or attachments or reply.
- KEYUCA says it never asks for passwords or card numbers by email; delete messages that do.
- Check sales and orders on the official KEYUCA site rather than through email links.
Check the other services you use →