How it grew. PayCloud's Oct 29 notice described one shared environment and about 3.01 million addresses. Its Nov 2 second report revises that environment to 3,386,187 deduplicated addresses from 61 client companies, plus up to 411,827 customer records with names and company names for five clients. Separately, from Oct 28 to 31, an attacker went from an Arara Message server into many of the service's client servers and exported database contents. PayCloud believes the same third party did both.
What was taken. Email addresses, whatever member fields each client registered (names, gender, birth dates, phone numbers, member IDs, addresses), and delivery records. Arara says it holds no credit card numbers. The cause was a web server vulnerability plus problems in the system environment; the entry point and start date are still under investigation.
The phishing wave. From Oct 28 to 30 the service itself was abused to send up to about 7.13 million emails posing as credit card companies, from the real sender address news@arara.com, to addresses the attacker brought in. Arara shut down all of Arara Message on Oct 31, has no restart date, and will make clients reset admin passwords and API keys before it comes back. A third report will cover counts and any hit to earnings.
Why this matters to an enterprise. An email delivery vendor holds your customer list and can send mail that passes as you, so one compromise becomes data theft at hundreds of companies at once plus phishing from a trusted sender. If you use a third-party mailer, check this week that its API keys and admin logins are scoped and rotated, that you know which customer fields you actually push to it, and that you'd spot a sudden send spike from your sending domain.