🔍 Read the full analysis: Osaka Data Breach: 1.08 Million Email Addresses Leaked Through A Vendor’s Vendor. What To Do on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka City confirmed on November 13 that 1,078,713 email addresses connected to its administrative online system were exposed in a breach at Arara Message, an email service used by the city’s provider, TKC Corporation. The city and TKC say the exposed information was limited to email addresses; they report no evidence that message contents, My Number data or application records were taken.
Osaka City confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed in a breach at Arara Message, an email delivery service used by system provider TKC Corporation. The city says it found no evidence that its own system was breached and says the exposed information was limited to email addresses, not message contents or application data.
The city’s final report counts addresses that received messages from its system between July 1 and October 31, 2026. Those messages included registration and account-change notices, login alerts, application updates and city announcements. Osaka says the total is high partly because the service sent a notice to every registered user on September 16. The count refers to email addresses, not a confirmed number of individuals.
According to Osaka, TKC matched information supplied by Arara against the city’s system records to identify the affected addresses. TKC said it received the leaked data from Arara on November 4 and began sorting it by customer and system that day. The city says it cannot tell individual users whether a specific address appears in the data.
TKC and the city say they have found no indication that email bodies, Japan’s My Number personal identification numbers, or application data were exposed. That is their account of the known scope; the city has asked TKC for a detailed report on the cause, the extent of the incident and safeguards against a repeat.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Why the Vendor Link Matters
The incident shows how a breach at a service used by a contractor can affect people who rely on a public agency’s online systems, even when the agency reports no intrusion into its own network. Arara was not Osaka’s direct system provider: TKC used Arara to deliver email, placing another company between the city and the affected service.
Exposed addresses can be used to send convincing impersonation messages, including emails pretending to concern city accounts, applications or payments. The city’s report does not say that the stolen addresses have been used in targeted scams. Still, people who received messages from the system during the stated period have reason to treat unexpected links and requests for credentials or payment details with caution.
The disclosure also raises practical questions about how public agencies review the security and incident-reporting arrangements of subcontractors. Osaka says it will review its handling of personal information in external services, safety-management measures and coordination with vendors. That review matters beyond this incident because government email systems often depend on multiple providers.
Popular right now
Hisense 40-Inch QD4SR Series Hi-QLED FHD Roku Smart TV
Breville Barista Express Espresso Machine with Built-In Grinder, Brushed Stainless Steel
Dyson Purifier Cool PC2 De-NOx
As an affiliate, we earn on qualifying purchases.
How the Breach Reached Osaka
Arara’s account, as summarized in the supplied company filings and reports, places the activity between late October and the end of that month. Arara said it observed possible reconnaissance on October 27. On October 28, an attacker accessed an administration screen in a shared environment and copied data, while the service began sending fake credit-card emails. Arara confirmed unauthorized access that day.
Arara initially reported about 3.01 million addresses taken from one shared system, then expanded its estimate as it identified further access through its service. Its November 6 report put the total at 81,329,467 email addresses after removing duplicates, drawn from systems serving up to about 380 client companies. The company has stressed that this is an address count, not a count of people.
On October 31, Arara shut down the environment TKC used for local-government systems. Osaka’s system then could not send email from about 17:40 Japan time, according to the timeline in the source material. Arara completed shutdown of its wider service later that evening. Osaka published earlier updates on November 3 and 4 before issuing its final report on November 13. November 2 was the date of an Arara report, not the date the source material identifies as the start of the attack.
“The email addresses of users of the system leaked to outside parties.”
— Osaka City, in its November 13 report
What the Reports Do Not Resolve
The published total is 1,078,713 email addresses, but the source material provides no confirmed count of affected people. Some users may have had more than one address, and the city has not said whether every address in the total belongs to a unique person. It also says it cannot confirm exposure for individual addresses.
The city’s and TKC’s assessment that only addresses were exposed is the stated scope of their findings. The materials provided do not include the full technical investigation, details of how the attacker accessed the shared environment, or an independent assessment of the companies’ conclusions. Osaka has requested a fuller report from TKC.
It is also not clear whether affected users will receive individual notifications. The city says that sending individual notices is under consideration. The available information does not establish whether the exposed addresses have been used for phishing or other follow-on activity.
City Review and User Alerts
Osaka says it has asked TKC for a detailed account of the breach, its scope and the steps being taken to prevent a repeat. The city also plans to review how personal information is handled by external services, the security measures applied to those services and how vendors coordinate during incidents. No deadline for those reviews was provided in the source material.
The city is considering whether to notify affected users individually, but has not announced a decision. It says it will not confirm whether a particular email address was involved. People who used the system can check announcements on the city’s official website rather than relying on links in unexpected messages.
For now, users should be wary of unsolicited email claiming to be from Osaka City, particularly messages asking them to sign in, provide passwords or payment-card information, or follow an unfamiliar link. The confirmed report describes an exposure of addresses; it does not establish that any such follow-up messages are connected to the breach.
Key Questions
How many email addresses did Osaka say were exposed?
Osaka City reported 1,078,713 email addresses linked to its administrative online system. This is a count of addresses, not a confirmed count of people.
Who may be affected?
The city says the addresses belong to recipients of system emails sent between July 1 and October 31, 2026, including account, login, application and announcement messages. It has not said whether it can confirm exposure for individual users.
What information does the city say was exposed?
Osaka and TKC say the exposed information was limited to email addresses. They report no evidence that email contents, My Number data or application records were leaked.
Where did the breach happen?
The breach was at Arara Message, an email delivery service used by TKC Corporation, the provider of Osaka’s online system. The city says it has not found a break-in to its own system.
What should users do now?
Be cautious with unexpected emails claiming to come from Osaka City. Do not enter passwords or payment details after following an email link; check information through the city’s official website instead.
Source: ThorstenMeyerAI.com
