🔍 Read the full analysis: Osaka’s 1.08 Million Email Leak: A Checklist For What To Do on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka City confirmed on November 13 that 1,078,713 email addresses used by its online administrative system were exposed after unauthorized access to Arara Message, an email service used by system provider TKC. The city and TKC say the exposed information was limited to email addresses; users should treat unexpected messages claiming to come from the city with caution and check the city’s website directly.
Osaka City confirmed November 13 that 1,078,713 email addresses associated with its online administrative system were exposed after an attacker accessed Arara Message, an email delivery service used by system provider TKC Corporation. The city and TKC say the exposed data was limited to email addresses, not message contents, Japan’s My Number personal identification numbers or application information.
The city’s notice covers addresses that received messages from its online system between July 1 and October 31, 2026. Those messages included account registration and login notices, password or email-address changes, applications, application-status updates and announcements. Osaka said the count is high because the system sent a notice to all registered users on September 16. People with an account then should treat their address as potentially included; the city says it cannot confirm exposure for individual addresses.
The breach occurred at Arara Message, which TKC used to deliver email, rather than at Osaka’s own system or TKC’s system, according to the city and the companies. Arara reported that a total of 81,329,467 email addresses were taken across its service after duplicate records were removed. The company said the data came from as many as about 380 client companies; the figure counts addresses, not verified individual people.
Arara’s account places unauthorized access and data copying on October 28, following apparent reconnaissance the previous day. The company said its service was used to access additional servers through October 31. Arara shut down the environment used for TKC’s local-government systems that day, disrupting Osaka’s ability to send email. TKC received the leaked address data from Arara on November 4 and began sorting it by customer and system, according to the supplied reports.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
How the Leak Changes Email Risks
The exposed addresses can make recipients more vulnerable to convincing impersonation emails, even though the city says message contents and application data were not exposed. An attacker who knows someone used Osaka’s online services can send a message that appears relevant to registration, a login, an application or a status update. The breach report does not establish that such messages have been sent to affected users, but the service’s own incident included fake credit-card emails, according to the supplied account.
For readers, the practical concern is not that an address alone proves an account has been taken over. It is that an unexpected email may prompt someone to reveal information or follow a harmful link. Treating email as an unverified alert channel and going directly to the city’s official website reduces the chance of responding to a spoofed message. The reported total also needs careful interpretation: 1,078,713 is an address count, and neither Osaka nor the supplied material gives a count of unique affected people.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones – Active Over‑Ear Noise Cancelling with Mic, USB‑C Charging, Deep Bass, up to 24 h Playtime,
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Samsung Odyssey OLED G5 27-Inch QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Arara Access to Osaka’s Confirmation
Arara first reported unauthorized access on October 28. Its parent company, PayCloud Holdings, disclosed a breach on October 29, initially reporting about 3.01 million addresses from one shared system. Arara later said data had also been taken through its service and that access had spread across more servers. On October 31, it shut down the environment used for TKC’s local-government systems; Osaka’s system then could not send email.
Arara’s November 2 report put the total at about 77 million addresses. TKC told Osaka that addresses, names and other details might have been affected, then reported on November 4 that only email addresses were involved. Arara’s November 6 report gave a revised total of 81,329,467 addresses after deduplication. Osaka published its final count on November 13. The supplied account cautions that November 2 was a reporting date, not the date of the intrusion; the described activity took place from October 27 through October 31.
“The email addresses of users of the system leaked to outside parties.”
— Osaka City, in its November 13 notice, translated from Japanese
What the Reports Do Not Establish
The published figure counts email addresses, not people; the number of unique individuals affected has not been provided. Osaka has not said whether it will send individual notices, describing them as under consideration. The city says it identified its addresses using information supplied by the service provider to TKC, which TKC then sorted and matched to customer systems.
The city and TKC say email contents and other personal information were not leaked, but the available account does not provide the detailed investigation report Osaka requested from TKC. The precise route used to access Arara’s systems, the full account of the incident and whether any Osaka users have received follow-up phishing messages are not established in the supplied material. Osaka has also said it will not confirm whether a specific address appears in the exposed data.
Osaka Seeks Vendor Findings
Osaka says it has requested a detailed report from TKC on the cause, scope and measures to prevent a repeat. The city also plans to review how personal information is handled by external services, its safety-management measures and coordination with vendors. It has not set out a date for publishing those findings or confirmed whether individual notices will be sent.
Until the city provides further guidance, users can follow the precaution in the incident notice: treat unexpected messages claiming to be from Osaka as suspect, do not enter passwords or payment-card details through links in those messages, and check information by visiting the city’s official website directly. Readers should rely on city updates for any later confirmation about notification plans or the investigation.
Key Questions
Whose email addresses may have been exposed?
Osaka says the affected addresses were recipients of messages from its online administrative system between July 1 and October 31, 2026. It says the September 16 notice went to all registered users, so people with an account then should assume their address may be included.
Was my password or application information leaked?
The city and TKC say the exposed information was limited to email addresses. They say message contents, My Number information and application data were not leaked. Osaka has not offered individual address checks.
How many people were affected?
The city confirmed 1,078,713 email-address records, not a count of unique people. The number of individuals represented has not been published.
What should I do if I receive an email claiming to be from Osaka?
Be cautious with unexpected messages, avoid clicking their links or entering passwords or card details, and check the information by going directly to Osaka City’s official website.
Will Osaka tell users individually?
The city says individual notices are under consideration. It has not confirmed a notification schedule and says it cannot verify whether a particular address was exposed.
Source: ThorstenMeyerAI.com
