🔍 Read the full analysis: Osaka Data Breach: 1.08 Million Email Addresses And What To Do Now on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka City confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed after a breach at Arara Message, an email service used by system provider TKC. The city and TKC say the leaked data was limited to email addresses; users should treat unexpected messages claiming to be from the city with caution.
Osaka City confirmed November 13 that 1,078,713 email addresses linked to its administrative online system were exposed after attackers accessed Arara Message, an email delivery service used by system provider TKC Corporation. The city and TKC say the leaked information was limited to email addresses, but the exposure makes fraudulent messages posing as city notices a concern for affected users.
The affected addresses belong to recipients of messages sent by the system from July 1 through October 31, 2026. Those messages covered account registration, email or password changes, logins, applications, application-status updates and announcements. Osaka said the total is large partly because the system sent a notice to all registered users on September 16.
The breach did not occur in Osaka City’s own system, according to the city, or in TKC’s systems, according to the provider. Instead, Arara Message was the compromised service used to deliver the city’s emails. TKC said Arara supplied it with the leaked data on November 4, after which TKC sorted the addresses by client and system so Osaka could identify the addresses associated with its service.
Osaka’s reported figure is a count of email addresses, not confirmed individual people. Arara said a total of 81,329,467 addresses were taken across its service after duplicates were removed, involving up to about 380 client companies. The city says email contents, Japan’s My Number personal identification number and application data were not exposed. It has not said whether individual users will receive direct notices.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Why the Email Exposure Matters
The data reported exposed is limited, but email addresses can still help criminals make convincing phishing messages. A recipient who has used Osaka’s online services may be more likely to trust a message referring to an account, application or city announcement. The breach does not establish that such messages have been sent to these users, but unexpected messages claiming to be from Osaka deserve extra scrutiny.
The incident also shows how a breach at an outside vendor can affect a public service even when the city and its main system provider report no intrusion into their own environments. Osaka says it has asked TKC for a detailed report on the cause, the scope and steps to prevent a repeat, and plans to review its handling of personal information in external services and coordination with vendors.
For residents, the practical advice is to avoid clicking links in unexpected messages or entering passwords or payment-card details after following them. Instead, users can go directly to the city’s official website to check notices. The city says it cannot confirm whether a particular address is affected.
Products Worth Considering
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID – Blush
Dell UltraSharp U3225QE 31.5-Inch 4K UHD 120Hz IPS Black Thunderbolt Hub Monitor
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
As an affiliate, we earn on qualifying purchases.
How the Vendor Breach Reached Osaka
Arara’s reported timeline places the incident in late October. TKC said Arara Message was briefly taken offline on October 22 in response to a PHP vulnerability. Arara later recorded apparent reconnaissance on October 27 and unauthorized access to an administrative screen in a shared environment on October 28, followed by data copying and the sending of fake credit-card emails through its service.
Arara said it shut down the environment used for local-government systems on October 31. Osaka’s system could no longer send email from about 5:40 p.m. that day, and Arara completed the shutdown of its service later that evening. TKC first received a report on October 30 saying there had been no leak from its own usage environment. On November 2, after further findings, TKC told Osaka that email addresses and other information might have been exposed; on November 4, it reported that the affected data was limited to addresses.
Arara’s November 6 report put the total taken from its service at 81,329,467 email addresses, after deduplication. Osaka published earlier updates on November 3 and 4, then issued its final report on November 13 at 1 p.m. Japan time, confirming the city-specific count.
““The email addresses of users of the system leaked to outside parties.””
— Osaka City, in its November 13 report
What the City Has Not Confirmed
The city has confirmed the number of affected email addresses, but it has not published a count of unique people. One person could have more than one address, and the source material does not establish how many addresses correspond to individual users. The 1,078,713 figure should therefore be understood as address records, not a confirmed number of people.
Osaka says email content, My Number data and application details were not leaked, consistent with TKC’s account that only email addresses were affected. The city has not published the detailed technical report it requested from TKC, including a full account of the cause and the measures planned to prevent a recurrence. Whether individual users will receive direct notification is also still under consideration.
The city says it cannot check whether a particular address appears in the exposed data. The available information does not establish that Osaka users have received phishing messages as a result of this breach, or that passwords or payment information were taken from the city’s system.
Pending Vendor Findings and User Notices
Osaka says it has requested TKC’s detailed report on the incident’s cause, scope and prevention measures. The city also says it will review how personal information is handled by external services, its safety-management practices and its system for working with vendors. It has not announced a date for those findings.
The city is considering whether to notify affected users individually, but has not confirmed that it will do so. For now, users should be cautious with messages claiming to come from Osaka City, avoid links that request credentials or card information, and consult the city’s website directly for service updates. Further information may follow when TKC’s report and the city’s review are available.
Key Questions
How many Osaka-related email addresses were exposed?
Osaka City reported 1,078,713 email addresses associated with its administrative online system. That is an address count, not a confirmed count of people.
Which users may be affected?
The city identifies recipients of system emails sent between July 1 and October 31, 2026. It said a notice sent to all registered users on September 16 contributed to the high total.
What information does Osaka say was leaked?
The city and TKC say the exposed data was limited to email addresses. They say email contents, My Number information and application data were not leaked.
How can I check whether my address was involved?
Osaka says it cannot confirm whether an individual email address is affected. The city is considering individual notices, but has not said whether they will be sent.
What should I do about emails claiming to be from Osaka City?
Treat unexpected messages with caution. Do not use a message link to enter a password or payment-card details; visit the city’s official website directly to check information.
Source: ThorstenMeyerAI.com
