Japanese crypto exchange Zaif disclosed that approximately 380,000 customer email addresses were leaked after its third-party email service provider Arara suffered unauthorized external access. The breach was contained to Arara's systems, with no intrusion detected in Zaif's own infrastructure. Zaif confirmed the compromised data is limited to email addresses and does not include names, transaction details, or passwords. No secondary harm such as asset losses has been reported so far. With Arara's services suspended, Zaif halted outgoing emails and urged customers to beware of phishing attempts impersonating either entity, recommending authentication apps for two-factor security.