According to Zaif's official announcement on November 5, the exchange's email service provider Arara suffered unauthorized external access, exposing approximately 380,000 customer email addresses (after deduplication). The leaked data contains only email addresses; customer names, transaction records, and passwords were not compromised.
Zaif confirmed its own systems remain uncompromised and that email addresses alone cannot be used to access accounts. No asset theft has been confirmed. The exchange has suspended email delivery services and warned customers to remain vigilant against phishing emails impersonating Zaif or Arara.