Zaif: Third-party service provider breached, over 380,000 customer email addresses leaked.

Japan's Zaif exchange said a breach at third-party email service provider Arara exposed 380,536 unique customer email addresses, with the exchange receiving the leaked list on November 4 and still assessing how many current users are affected. Zaif said only email addresses were registered with the provider, with no names, trading data or passwords involved, and that its own systems were not compromised, with no unauthorized logins or asset outflows detected. The exchange has suspended notification emails because of the provider outage and will contact affected customers individually once service resumes, warning users to watch for phishing messages impersonating Zaif. The incident highlights the counterparty risk that crypto exchanges carry through outsourced service providers even when their own infrastructure holds.