🔍 Read the full analysis: Osaka Email Address Breach: What Happened And What To Do Next on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka City confirmed on November 13 that 1,078,713 email addresses connected to its online administrative system were exposed in a breach at Arara Message, an email service used by system provider TKC. The city and TKC say the leak included email addresses only, not message contents, My Number details or application data. Users should treat unexpected messages claiming to be from the city with caution and verify information through official channels.
Osaka City confirmed November 13 that 1,078,713 email addresses linked to users of its administrative online system were exposed in a breach at Arara Message, an email delivery service used by system provider TKC Corporation. The city says its own system was not breached and that the exposed data did not include email contents, My Number details or application information.
The city’s final report identifies the affected addresses as recipients of emails sent through the system between July 1 and October 31, 2026. Those messages covered account registration, email-address or password changes, logins, applications, application-status updates and city announcements. Osaka said the count is high partly because the system sent a notice to every registered user on September 16.
TKC said it received the exposed address data from Arara on November 4 and began sorting it by customer and system. Osaka says it used information supplied by TKC to identify addresses associated with its service. The city’s figure counts email-address records, not confirmed individual people; no count of affected people has been published.
Arara reported that 81,329,467 email addresses were taken from its service in total after duplicate entries were removed. The company said the data came from as many as about 380 client companies. That broader total is separate from Osaka’s count and does not establish how many people were affected across all clients.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Why the Exposed Addresses Matter
An email address alone does not grant access to an account, and Osaka says passwords and application data were not exposed. But the addresses can be used to target users with messages that imitate city notices or refer to online-service activity. The risk is heightened because the affected addresses were used for account and application-related communications.
People who received a message claiming to be from Osaka should avoid using links in unexpected emails, particularly links asking for passwords or payment-card details. They can check notices by visiting the city’s website directly or using a known official contact route. This is a precaution based on the nature of the exposed data; the city has not said that the leaked addresses have been used in a specific phishing campaign.
The incident also highlights that a service can be affected through a supplier even when the city’s own system has not been found to have been breached. Osaka said it has asked TKC for a detailed report and will review how personal information is handled by external services and how vendors coordinate with the city.
Products Worth Considering
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID (Midnight)
DJI Mini 5 Pro Fly More Combo Plus with DJI RC 2
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
As an affiliate, we earn on qualifying purchases.
How the Vendor Breach Unfolded
According to TKC and Arara’s reports, Arara detected suspicious activity in late October. It reported that an attacker accessed an administration screen in a shared environment on October 28 and copied data. Arara’s service also began sending fraudulent credit-card emails, according to the incident timeline supplied in the source material.
Arara shut down the environment used for TKC’s local-government systems on October 31, after finding that the intrusion had reached additional servers. Osaka’s online system could no longer send email from about 17:40 Japan time that day. Arara completed the shutdown of its broader service later that evening. The shutdown disrupted email delivery; it does not by itself mean Osaka’s user accounts or application records were accessed.
Early estimates changed as the investigation progressed. Arara first reported about 3.01 million addresses from one shared system, then increased its estimate in later reports, reaching 81,329,467 addresses after deduplication in a November 6 update. Osaka issued its final count on November 13. The date of that final confirmation should not be confused with the reported intrusion, which took place in October.
“Users’ email addresses, 1,078,713 records.”
— Osaka City, in its November 13 report
What the Investigation Has Not Resolved
The city has not said whether it will send individual notices to affected users; it says that option is under consideration. It has also said it cannot check or confirm whether a particular address was included, so users should not expect an individual lookup through the city.
The precise number of people affected is unknown because the published figures count email addresses, not individuals. The available reports also do not establish that every address corresponds to a unique person. Osaka has asked TKC for a fuller account of the cause, scope and steps to prevent a repeat, but the source material does not provide the completed findings.
Osaka and TKC say the exposed data was limited to email addresses, while Arara’s wider incident involved information taken from its service. The city’s statements describe the data linked to Osaka’s system; they should not be read as a full description of every client’s exposure. The source material does not confirm whether the stolen addresses have since been used to target Osaka users.
City Review and User Precautions
Osaka says it has requested a detailed incident report from TKC and will re-examine its handling of personal information in external services, vendor safety measures and coordination procedures. It has not announced a date for those findings or a decision on individual notices.
For now, users should treat unsolicited messages claiming to be from the city as unverified, avoid entering credentials or card details through email links, and check relevant information on Osaka’s official website. Anyone concerned about an account should access the service through a saved or independently located official address rather than a link in an unexpected message. The city has not advised that users’ passwords need to be reset based on the reported email-address exposure alone.
Key Questions
How many Osaka-related email addresses were exposed?
Osaka City confirmed 1,078,713 email-address records linked to its online administrative system. The figure is a count of addresses, not a confirmed count of people.
Were passwords, My Number details or application records leaked?
The city and TKC say the Osaka-related exposure was limited to email addresses. They say email contents, My Number details and application data were not leaked.
Can I ask the city whether my address was affected?
Osaka says it cannot confirm whether an individual email address is included. It has not announced individual notifications; those are under consideration.
What should I do if I receive an email claiming to be from Osaka City?
Do not follow unexpected links or provide passwords or payment-card details in response. Check information by going directly to the city’s official website or using a contact method you already trust.
Was Osaka City’s own online system hacked?
The city says no breach of its own online system has been found. The reported intrusion occurred at Arara Message, an email delivery service used by TKC, the city system’s provider.
Source: ThorstenMeyerAI.com
