🔍 Read the full analysis: Osaka Data Breach: The Email Leak, Vendor Chain, And Your Response on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka confirmed on November 13 that 1,078,713 email addresses linked to its administrative online system were exposed in a breach at Arara Message, a service used by system provider TKC. The city and TKC say the leak was limited to email addresses; the number of individual people affected is unknown.
Osaka confirmed November 13 that 1,078,713 email addresses associated with users of the city’s administrative online system were exposed in a breach at Arara Message, an email delivery service used by system provider TKC Corporation. The city and TKC say the exposed information was limited to email addresses, not message contents, My Number identification data or application records.
The city’s November 13 report counts addresses that received messages from the system between July 1 and October 31, 2026. Those emails covered account registration and changes, logins, applications, application-status updates and announcements. Osaka said the count is high in part because it sent a notice to all registered users on September 16. People with accounts on that date should assume their addresses may be included, although the city says it cannot confirm whether any particular address was affected.
The breach occurred farther down the vendor chain than Osaka’s own system. TKC used Arara Message to deliver email; Arara reported unauthorized access to its environment and the removal of address data. Osaka says it found no break-in at its own online system, while TKC said no breach of its own usage environment had been reported. The city said it identified the affected addresses using information Arara supplied to TKC, which then sorted and matched the data to customer systems.
Arara said its investigation found 81,329,467 email addresses taken across its service after duplicates were removed. The company said the data involved up to about 380 client companies and stressed that the count refers to email addresses, not people. That broader total is distinct from Osaka’s system-specific count; no published figure establishes how many individual people are represented in either number.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Why the Vendor Breach Reaches Osaka Users
The incident shows how a breach at a third-party service can expose information tied to a public system even when the city’s own platform has not been found compromised. Arara handled email delivery for TKC, which provided Osaka’s online system, placing residents’ addresses in a chain involving multiple organizations.
Email addresses can be used to target recipients with messages that appear to relate to city accounts, applications or service updates. Osaka users should treat unexpected messages claiming to be from the city cautiously, particularly those asking them to follow a link or provide credentials or payment details. This is practical caution, not confirmation that any specific phishing campaign has targeted Osaka users.
The scale also matters for people who do not recognize the system’s name: the city says the list covers recipients of its messages over a four-month period, and the September 16 notice sent to all registered users expanded the number of addresses involved. The figures describe records, however, not a verified count of distinct people.
Products Worth Considering
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Cypress Green
Bose QuietComfort Wireless Headphones – Twilight Blue (Limited Edition)
Jackery Solar Generator 1000 v2 with 100W Solar Panel
As an affiliate, we earn on qualifying purchases.
How the Email Vendor Chain Failed
Arara’s reported timeline places the activity in late October. It said it observed apparent reconnaissance on October 27; on October 28, an attacker accessed an administrator screen in a shared environment and copied data. Arara also said its service began sending fake credit-card emails that day. Its October 29 preliminary disclosure cited about 3.01 million addresses from one shared system. Later reports expanded the scope as the company traced data taken through its service.
On October 31, Arara shut down the environment used by TKC for local-government systems at 17:37 Japan time. Osaka’s system could no longer send email from about 17:40. Arara said it completed a shutdown of its service at 19:53. TKC subsequently told Osaka that user addresses, and potentially other details, might have been involved; on November 4, it reported that only email addresses were affected. Osaka issued its final count on November 13.
The dates matter because November 2 was the date of an Arara report, not the start date of the intrusion described in the company’s filings. The reported activity ran from late October through the service shutdown. Osaka’s final announcement, rather than earlier provisional figures, gives the city-specific total of 1,078,713 addresses.
““The email addresses of users of the system leaked to outside parties.””
— City of Osaka, November 13 report
What the Published Counts Cannot Show
The number of distinct people affected remains unknown. Osaka’s 1,078,713 figure counts email addresses, and Arara’s wider total also counts addresses; the available reports do not establish how many belong to unique individuals, whether any person had more than one address in the data, or how many addresses were active.
The city says it cannot answer inquiries about whether an individual address is included. It has said individual notices are under consideration, but has not confirmed whether or when they will be sent. Osaka also requested a more detailed report from TKC on the cause, scope and prevention measures. The material available does not provide the final technical findings behind the intrusion or a complete account of how the attacker gained access.
The city and TKC say the leak did not include email bodies, My Number data or application information. Those statements describe the findings reported so far; the city says its review of vendor information handling and safety measures is continuing.
Osaka Reviews Vendor Safeguards
Osaka has asked TKC for a detailed account of the incident, including its cause, full scope and measures to prevent a recurrence. The city says it will review how external services handle personal information, the safety controls applied to those services and coordination among vendors. The timing and contents of the requested report have not been announced.
People who received messages from info-osaka-online@city.osaka.lg.jp between July 1 and October 31 should be alert for unexpected messages claiming to come from Osaka. Do not use a link in an unsolicited email to enter a password or card details; instead, check notices by going directly to the city’s official website. The city has not said that every message from that address is fraudulent, nor has it published a process for checking a particular address against the exposed data.
Key Questions
What information did Osaka confirm was exposed?
Osaka confirmed that 1,078,713 email addresses associated with users of its administrative online system were exposed. The city and TKC say the leak did not include email contents, My Number data or application records.
Who may be affected?
The city’s count covers addresses that received system emails between July 1 and October 31, 2026. Osaka sent a notice to all registered users on September 16, so users with an account then should assume their address may be included. The city says it cannot check individual addresses for users.
Was Osaka’s online system itself breached?
The city says it has found no break-in at its online system. It attributes the exposure to unauthorized access at Arara Message, an email delivery service used by TKC, the system provider.
Does the leak affect 1,078,713 people?
That figure counts email addresses, not confirmed individual people. Neither Osaka nor the cited reports has published a count of distinct people represented by the addresses.
What should recipients do now?
Treat unexpected emails claiming to be from Osaka cautiously. Avoid entering passwords or payment-card details through email links, and check information by visiting the city’s official website directly.
Source: ThorstenMeyerAI.com
