🔍 Read the full analysis: Osaka Data Breach And Vendor Risk: A Guide For Email Users on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka City confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed in a breach at Arara Message, an email service used by system provider TKC. The city and TKC say the incident exposed email addresses, not message contents, My Number details or application data; the number of individual people affected is unknown.
Osaka City confirmed November 13 that 1,078,713 email addresses associated with users of its administrative online system were exposed in a breach at Arara Message, an email delivery service used by system provider TKC Corporation. The city and TKC say the exposed information was limited to email addresses; they report no leak of message contents, My Number details or application data.
The city’s final report covers recipients of emails sent by the system from July 1 through October 31, 2026. Those messages included account registration and changes, password and login notices, applications, application-status updates and announcements. Osaka said the large total reflects a notice sent to all registered users on September 16. The figure counts email addresses, not confirmed individuals; no public count of distinct people affected has been provided.
According to Osaka, the addresses were identified using information Arara supplied to TKC, which sorted and matched the data against its customers’ systems. TKC said it received the leaked addresses from Arara on November 4 and began organizing them by customer and system. The city says it cannot tell people whether a particular address is included and is considering whether to contact affected users individually.
The incident occurred outside Osaka’s own system and outside TKC’s system environment, according to the city and the companies. Arara reported unauthorized access to a shared environment and data removal. Its November 6 report put the total at 81,329,467 email addresses across its service after duplicate entries were removed, potentially involving about 380 client companies. That broader number is not an estimate of Osaka users.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Why the Vendor Breach Reaches Osaka Users
The incident shows how a breach at an email provider can expose contact information tied to public services even when the city says its own online system was not entered. An exposed address can make a fraudulent message seem more credible, especially when the person has recently used a government service or expects an application update. The breach report does not establish that attackers have used the Osaka addresses in targeted messages, but the exposure creates a reason for users to treat unexpected mail with care.
For affected users, the reported scope is narrower than a leak of account credentials or application records: Osaka and TKC say email addresses alone were exposed. That distinction matters, but it does not make unsolicited messages harmless. Users should avoid entering passwords or payment-card details after following an unexpected email link and should check notices through the city’s official website or service rather than relying on the message.
For public agencies, the event also puts attention on vendor access and oversight. Osaka says it will review how personal information is handled by external services, safety-management measures and coordination with vendors. The city has asked TKC for a detailed account of the cause, scope and steps to prevent a repeat.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
DJI Mic 3 (2 TX + 1 RX + Charging Case) Wireless Microphone
As an affiliate, we earn on qualifying purchases.
How the Email Provider Was Compromised
The reported incident unfolded across several days in late October. TKC said Arara Message was temporarily taken offline on October 22 in response to a PHP vulnerability. Arara later recorded apparent reconnaissance on October 27 and unauthorized access to an administration screen in a shared environment on October 28, followed by data copying. Arara also said its service began sending fake credit-card emails that day.
Arara’s parent company, PayCloud Holdings, disclosed an initial estimate of about 3.01 million addresses on October 29. Arara later found that data had also been carried out through its service as the attacker accessed more servers. On October 31, Arara shut down the environment used for local-government systems; Osaka’s system then could not send email. Arara completed shutting down its service that evening.
Arara’s November 2 report raised its estimate to about 77 million addresses, and a November 6 report put the total at 81,329,467 after duplicates were removed. Those dates refer to company reports, not the start of the attack. Osaka published initial notices on November 3 and 4 before confirming its own system’s address count on November 13.
““It has been confirmed that the email addresses of users of the system leaked to outside parties.””
— Osaka City, in its November 13 report
What Osaka Has Not Identified
The city has published an address count but not a count of distinct people. One person may have more than one address, and the available reporting does not establish how many people are represented by Osaka’s 1,078,713 records. Osaka also says it cannot verify individual addresses in response to inquiries.
The city and TKC say the leaked information was limited to email addresses, and say message bodies, My Number details and application data were not exposed. The source material does not provide a technical account sufficient to independently assess how the attackers accessed Arara’s environment, or whether every potentially affected address has been identified. Arara’s overall figure covers multiple clients and should not be read as a count of people or Osaka users.
It is also not clear whether Osaka will send individual notices. The city says that step is under consideration, and it has requested a detailed report from TKC. The source material does not confirm that the leaked addresses have been used in a new phishing campaign targeting Osaka users.
City Reviews Vendor Safeguards
Osaka says it has asked TKC to provide a detailed report covering the cause of the incident, its scope and measures to prevent a recurrence. The city says it will review how external services handle personal information, the safety-management measures in place and how it coordinates with vendors. It has not announced a completion date for that review or a timetable for any individual user notices.
For now, users who received email from info-osaka-online@city.osaka.lg.jp between July 1 and October 31 should be alert to messages claiming to be from Osaka. Do not use an unexpected link to enter passwords or card details; instead, check the city’s website directly. This precaution does not mean a particular message is fraudulent, and the city has not said that all messages from the address are unsafe.
Key Questions
What information did Osaka say was exposed?
Email addresses associated with the city’s administrative online system. Osaka and TKC say email contents, My Number details and application data were not leaked.
How many Osaka email addresses were affected?
The city reported 1,078,713 email addresses. That is an address count, not a confirmed count of individual people.
Who may be included in Osaka’s count?
The count covers recipients of system emails sent from July 1 to October 31, 2026, including account, login, application and service-announcement messages. Osaka said a September 16 notice sent to all registered users contributed to the large total.
Was Osaka City’s online system itself breached?
The city says it has found no break-in to its own online system. It attributes the exposure to unauthorized access at Arara Message, an email delivery service used by TKC, the system provider.
What should users do about emails claiming to be from Osaka?
Treat unexpected messages cautiously. Do not enter passwords or payment-card information after clicking an email link; visit the city’s official website directly to check information. Osaka says it cannot confirm whether a specific address was affected.
Source: ThorstenMeyerAI.com
