The email privacy roundup for 3 to 9 November 2026 covers seven stories. Paycloud Holdings disclosed that about 77 million email addresses were taken, or may have been taken, from Arara Message. Ryohin Keikaku extended the MUJI disclosure to card numbers in about 1.09 million records. Have I Been Pwned listed a Harvard dataset. NTT Docomo, Gnosis Pay and SM Entertainment each reported a breach, and Google set January 2027 as the end of Gmail Send As for third-party email addresses.
Arara Message breach
On 2 November 2026, Paycloud Holdings reported unauthorised access to Arara Message. About 77 million email addresses were taken, or may have been taken, from 97 dedicated servers. Up to about 380 client companies were affected. Between 28 and 30 October 2026, up to about 7.13 million messages impersonating credit card companies were sent through the service. The full account is in Arara Message data breach.
MUJI second report
Ryohin Keikaku issued a second MUJI report on 4 November 2026. It added card numbers in about 1.09 million MUJI Card records to the disclosure. Up to about 27.26 million app records, including email addresses, had already been covered. The figures are worded as information that may have leaked. No leak to the dark web and no misuse had been confirmed when the second report appeared. The full account is in MUJI data breach second report.
Harvard listing
Have I Been Pwned added the Harvard dataset on 3 November 2026. It holds 850,537 email addresses, with a breach date of November 2025. Harvard found the intrusion on 18 November 2025, after a phone-based phishing attack. People were notified by email on 22 November 2025. The full account is in Harvard data breach.
NTT Docomo breach
NTT Docomo confirmed unauthorised access to Docomo Online Shop and My docomo. Up to 300,000 customer records leaked, including email addresses and bank details. The full account is in NTT Docomo data breach.
Gnosis Pay breach
Gnosis Pay disclosed the breach on 6 November 2026. The legacy system behind its branded Visa debit cards was affected. Unauthorised access was detected on 3 November, and containment began within two hours. Customer notices reviewed by Cointelegraph listed full card numbers, expiry dates, CVV codes, names, home addresses, linked wallet addresses, email addresses and phone numbers. No victim count was given. Customer funds were not affected. The full account is in Gnosis Pay data breach.
SM Entertainment breach
SM Entertainment disclosed the breach on 8 November 2026. An external attacker had entered its business systems around 4 November and removed stored document files. The files held employee identity and bank data, including resident registration numbers, bank account numbers, mobile phone numbers and addresses. Three companies were affected: SM Entertainment, DearU and Dream Maker Entertainment. No victim count was disclosed. The full account is in SM Entertainment data breach.
Gmail Send As change
Google's Gmail Help page states that Gmail no longer supports Send As for third-party email addresses from January 2027. The change applies on the web and in the Gmail mobile apps. Gmailify and POP fetching of third-party accounts end at the same time. Send As for Gmail and Google Workspace addresses is not affected. People who set up Gmail Send As manually to send from an alias address are affected by the change. The source is Learn about changes to third-party email account support in Gmail.
Further stories published this week
The week also brought breach articles on Suntory, affecting around 100,000 people and disclosed on 2 November 2026; M1, covering customer names, NRIC numbers and email addresses; DigiCert, covering archived customer records; Iris Plaza, covering up to 7.7 million records; Mirae Asset Securities, covering about 3,800 accounts and data of 35,255 staff; Who Gives A Crap, a marketing vendor incident that exposed names, emails and phone numbers; and Nojima and iStyle Cosme, both published on 3 November 2026. The guide on how to check if an email was leaked covers checking whether an address appears in a breach, and the guide on what to do when an email is in a data breach covers the response.
AliasFleet provides email aliases that forward mail to a verified destination inbox. Two-way reply and Quick Send do not use Gmail Send As.
Top comments (0)