SMBC reports leak of 227,216 email addresses after third-party service breach
SMFG•Sumitomo Mitsui Banking disclosed that unauthorized access to Arara’s email distribution service exposed 227,216 email addresses. The exposed information did not include bank account details or login credentials.
1. Email addresses exposed
Sumitomo Mitsui Banking disclosed on November 5, 2026, that unauthorized access to Arara’s email distribution service exposed 227,216 email addresses. The leak covered recipients of SMBC emails sent from July 1 to October 31, 2026, primarily corporate customers.
2. Investigation underway
Arara initially reported no evidence of a leak on October 28, but further investigation confirmed the exposure on November 2. SMBC said affected customers could face impersonation emails and that it will investigate the breach’s timing, methods and scope with Arara and report the incident to relevant authorities.
