🔍 Read the full analysis: Osaka Data Breach: Understanding The 1.08 Million Email Exposure on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Osaka City confirmed on November 13 that 1,078,713 email addresses associated with its online administrative system were exposed after an attacker accessed Arara Message, an email delivery service used by system provider TKC. The city and TKC say the breach exposed email addresses only, not message contents, My Number data or application details; the number of affected individuals has not been published.
Osaka City confirmed November 13 that 1,078,713 email addresses associated with its administrative online system were exposed after an attacker accessed Arara Message, an email service used by system provider TKC Corporation. The city and TKC say the exposed information was limited to email addresses; the number of affected people is unknown, and the city says it cannot verify individual addresses on request.
The city’s final report counts addresses belonging to recipients of messages sent by its system between July 1 and October 31, 2026. Those messages included account registration and email or password changes, login notices, application updates and city announcements. Osaka said the count is high partly because the system sent a notice to every registered user on September 16. People with an account at that time should treat their address as potentially included, although the city has not published an individual lookup tool.
According to Osaka, TKC identified the city-related addresses by matching information Arara provided against the systems TKC supports. TKC said it received the exposed-address data from Arara on November 4 and began sorting it by customer and system. Arara reported a total of 81,329,467 email addresses taken across its service, after removing duplicates. The company said the data involved up to about 380 client companies; that total is not a count of people or Osaka users.
Osaka and TKC say email addresses were the only Osaka-system information exposed. They say email contents, Japan’s My Number personal identification numbers and application data were not leaked. The city has asked TKC for a detailed account of the cause, the affected scope and steps to prevent a recurrence. It said individual notifications were under consideration, but did not commit to sending them.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Why the Address Exposure Matters
An exposed address can make it easier for criminals to send convincing phishing messages that appear to relate to city accounts, applications or notices. The incident does not, based on the city and vendor accounts, give attackers passwords or application records. Still, users may receive unsolicited messages that use Osaka-related language or imitate the system’s usual notifications.
The practical risk is heightened by the range of messages the system sent. A person who received a registration, login or application-status email may reasonably expect follow-up messages from the city. That familiarity can make a fraudulent link seem legitimate. Residents should be cautious with unexpected messages, avoid entering passwords or payment-card information after following an email link, and check notices through the city’s official website or service rather than replying to the message.
The incident also shows how exposure can occur through a supplier further down a service chain. Osaka says its own online system was not found to have been breached, and TKC likewise said no intrusion into its own system was found. The compromised service was operated by Arara, which handled email delivery for TKC. For residents, the distinction explains where the reported access occurred, but it does not remove the need for the city and its vendors to account for how user data was handled across that chain.
Products Worth Considering
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
How the Vendor Breach Spread
Arara’s account places the incident in a shared service environment. The company reported apparent reconnaissance on October 27 and said an attacker accessed an administrative screen and copied data on October 28. Arara also reported that its service sent fake credit-card emails that day. It confirmed unauthorized access and later found that the activity had extended through its service to additional servers.
On October 31, Arara shut down the environment used by TKC for local-government systems. Osaka’s system could no longer send email from about 5:40 p.m. Japan time, according to the timeline in the source reports; Arara completed its wider service shutdown later that evening. Arara’s early public figures changed as its investigation expanded: its October 29 disclosure cited about 3.01 million addresses from one shared system, while a November 2 report put the broader total at about 77 million. On November 6, it reported 81,329,467 after deduplication.
Osaka’s first notices came on November 3 and 4, as TKC was still examining the scope. TKC initially warned that addresses, names and other details might have been affected, then told the city on November 4 that the Osaka-related exposure was limited to email addresses. The city’s November 13 final report confirmed its count. In this timeline, November 2 is the date of an Arara report, not the date the source material identifies as the attack itself.
““The email addresses of users of the system leaked to outside parties.””
— Osaka City, in its November 13 incident report
What the City Has Not Confirmed
The published count is a count of email address records, not people. Osaka has not said how many unique individuals are represented, whether some residents had multiple addresses in the system, or how many addresses remain in active use. Arara’s broader total also refers to addresses across its customers and should not be read as a count of people or accounts.
The city has not confirmed whether every address in the July 1-October 31 recipient group was taken, or published a list or lookup service for affected users. It says it matched data supplied by Arara through TKC, but a more detailed account of that process has not been included in the material available here. The city is considering individual notifications.
The reported limits on exposed data come from the city and TKC’s findings. Their statements say message contents, My Number information and application data were not affected. The source material does not provide a full independent technical assessment, nor does it include the detailed report Osaka has requested from TKC. The precise cause of the access, the complete route through Arara’s systems and the final corrective measures remain to be fully documented.
City Review and Resident Precautions
Osaka says it has requested TKC’s detailed report on the breach’s cause and scope, as well as measures to prevent a repeat. The city also plans to review how personal information is handled by external services, vendor safety practices and coordination between the city and contractors. It has not announced a publication date for the requested report or a schedule for individual notifications.
Until the city provides further information, residents should treat unexpected messages claiming to come from Osaka City with care. Do not use an email link to enter account credentials or payment information; instead, reach the city’s services through its official website. A message’s apparent sender name or address alone does not establish that it is genuine. The city’s published guidance, rather than an unverified email, is the source for updates.
The next public milestones are likely to be any further disclosure by Osaka or TKC about the investigation, safeguards and notification plans. For now, the confirmed figure is 1,078,713 email addresses tied to Osaka’s system; the number of affected people and whether residents will receive direct notice remain unsettled.
Key Questions
What information was exposed in the Osaka incident?
Osaka City and system provider TKC say the exposed information was email addresses only. They say message contents, My Number data and application information were not leaked.
Does 1,078,713 mean that more than a million people were affected?
No. The figure counts email addresses, not confirmed individuals. Osaka has not published a count of unique people, and it has not said whether some people had more than one address registered.
Who may be included in Osaka’s count?
The city says the addresses belonged to recipients of system emails sent from July 1 through October 31, 2026. It also said a notice went to all registered users on September 16, contributing to the total.
Can I ask Osaka whether my address was affected?
The city says it cannot answer individual inquiries about whether an address is included. It is considering individual notifications, but has not confirmed whether they will be sent.
What should residents do about emails claiming to come from Osaka?
Treat unexpected messages cautiously. Do not enter passwords or card details through links in an email; check information through Osaka City’s official website instead.
Source: ThorstenMeyerAI.com
