🔍 Read the full analysis: Osaka Data Breach: Protect Your Accounts After 1.08 Million Emails Leak on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka City confirmed on November 13 that 1,078,713 email addresses linked to its online administrative system were exposed through a breach at Arara Message, an email delivery service used by system provider TKC. The city and TKC say the exposed information was limited to email addresses; they say message contents, My Number data and application details were not leaked. The number is a count of addresses, not a confirmed count of people.
Osaka City confirmed November 13 that 1,078,713 email addresses associated with its online administrative system were exposed after attackers accessed Arara Message, an email delivery service used by system provider TKC Corporation. The city and TKC say the exposure was limited to addresses, not email contents or application records, but affected users should be alert to unexpected messages claiming to come from the city.
The city’s final report identifies addresses belonging to recipients of emails sent by the system between July 1 and October 31, 2026. Those messages covered account registration, email or password changes, logins, applications, application-status updates and announcements. Osaka says the number is high in part because the system sent a notice to all registered users on September 16. People with an account then should treat their address as potentially included, although the city says it cannot confirm exposure for an individual address.
According to Osaka and TKC, the city’s system and TKC’s own systems were not found to have been breached. The compromised service was operated by Arara Message, which TKC used to distribute emails. Arara reported that 81,329,467 email addresses were taken across its service after duplicates were removed, involving data from as many as about 380 client companies. That is a total across customers, not a count of people or Osaka users.
The city says it identified its affected addresses using information Arara supplied to TKC, which sorted the data by customer and system. TKC said it received the exposed addresses from Arara on November 4. Osaka has asked TKC for a detailed account of the cause, scope and steps to prevent a repeat, and says it will review how external services handling personal information are managed.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Why the Email Exposure Matters
An exposed email address can make a person easier to target with phishing messages, including emails that imitate a government service or refer to account activity. The breach report does not establish that anyone has used Osaka users’ addresses in targeted fraud, but the city-related sender and subject matter could make a deceptive message seem credible. The immediate risk is that recipients may be prompted to click a link or provide information.
The scope also illustrates how a breach at a third-party service provider can affect users of a public system even when the city’s own network is not reported compromised. Osaka’s stated limit—email addresses only—reduces what the incident confirms was exposed, but the available information does not establish whether addresses were subsequently used or shared beyond the reported theft.
Products Worth Considering
LG UltraGear evo 27-inch 5K Mini-LED Gaming Monitor
Dell UltraSharp U3225QE 31.5-Inch 4K UHD 120Hz IPS Black Thunderbolt Hub Monitor
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
How the Provider Breach Unfolded
Arara’s account and filings, as summarized in the source material, place the activity between late October and the service shutdown on October 31. The company recorded what it described as apparent reconnaissance on October 27. On October 28, an attacker accessed an administrative screen in a shared environment and copied data; Arara also reported that its service began sending fake credit-card emails. Arara confirmed unauthorized access that day.
Arara initially reported a smaller exposed-address count and later revised it. On October 29, its parent company disclosed about 3.01 million addresses from one shared system. Arara’s November 2 report put the count at about 77 million; its November 6 report gave the total as 81,329,467 addresses after duplicate removal. The November 2 date refers to a report, not the start of the attack.
On October 31, Arara shut down the environment used for TKC’s local-government systems at 17:37 Japan time, according to the timeline in the source material. Osaka’s system could no longer send email from about 17:40. Arara completed the shutdown of its wider service at 19:53. Osaka issued earlier updates on November 3 and 4, before publishing its final count on November 13.
““Users’ email addresses, 1,078,713 records.””
— Osaka City, in its November 13 notice
What the Report Does Not Establish
The reported 1,078,713 figure counts email addresses; Osaka has not published a count of distinct people affected. The city’s notice identifies the relevant system and date range but says it cannot tell an individual whether their address was included. It is also not clear from the available reports whether Osaka will send direct notices to affected users; the city said individual notification was under consideration.
The city and TKC say email contents, My Number identifiers and application data were not leaked. The reports described here do not establish whether the stolen addresses have been misused, whether other information held by Arara was accessed, or what the full results of the provider’s investigation will be. Those points remain subject to further reporting and the detailed review Osaka has requested.
City and Provider Reviews Continue
Osaka says it has requested a detailed report from TKC on the breach’s cause, its scope and measures to prevent a recurrence. The city also plans to review its handling of personal information in external services, safety-management measures and coordination with vendors. The source material does not give a deadline for those reviews or say when the requested report will be published.
For now, users can reduce the risk of responding to an imitation message by treating unexpected emails claiming to be from Osaka as suspicious. Do not enter passwords or payment-card details through a link in an unsolicited message; instead, check information by going directly to the city’s official website. The confirmed exposure concerns email addresses, and users should distinguish that fact from unverified claims about additional data or individual misuse.
Key Questions
What information did Osaka say was exposed?
Osaka and TKC say 1,078,713 email addresses linked to the city’s online administrative system were exposed. They say email contents, My Number data and application information were not leaked.
Does the figure mean more than one million people were affected?
No distinct-person count has been published. The reported figure is a count of email addresses; it does not establish how many individuals those addresses represent.
Who should treat their address as potentially exposed?
The city’s scope covers recipients of system emails sent between July 1 and October 31, 2026. Osaka says a notice went to all registered users on September 16, so users registered then should assume their address may be included.
Was Osaka City’s own online system hacked?
The city says it found no break-in at its online system, and TKC likewise said its systems were not found breached. The reported access occurred at Arara Message, the email delivery service used by TKC.
What should users do about suspicious emails?
Do not click links in unexpected messages claiming to be from Osaka or enter passwords or card details after following a link. Check notices by going directly to the city’s official website; Osaka says it cannot verify exposure for individual addresses.
Source: ThorstenMeyerAI.com
