🔍 Read the full analysis: Osaka Data Breach Exposes 1.08 Million Email Addresses Through A Vendor’s Vendor on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka confirmed that 1,078,713 email addresses linked to its administrative online system were exposed in a breach at Arara Message, an email service used by provider TKC. The city and TKC say the exposed data was limited to email addresses, not message contents, My Number data or application information. The number refers to addresses, not a confirmed count of people.
Osaka City confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed after attackers accessed Arara Message, an email delivery service used by the system’s provider, TKC Corporation. The city says its own system was not breached and that the exposed information was limited to email addresses, leaving the number of affected individuals unconfirmed.
The city’s final report says the affected addresses belong to recipients of system emails sent from July 1 to October 31, 2026. Those messages included account registration and login notices, password or email changes, application submissions and status updates, and city announcements. Osaka said the count is high in part because the system sent a notice to all registered users on September 16.
The exposure occurred at Arara Message, which TKC used to deliver email for the online system. TKC and Osaka say they have found no evidence that Osaka’s system or TKC’s own environment was accessed in the incident. The city says email contents, My Number data and application information were not leaked; according to its account, only addresses were affected.
Arara reported that 81,329,467 email addresses were taken from its service after duplicates were removed, across as many as about 380 client companies. The company cautioned that the total counts addresses, not people. TKC said it received the leaked address data from Arara on November 4 and began sorting it by customer and system. Osaka says it used information provided through TKC to match the exposed data to its system.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Why the Vendor Chain Matters
The incident shows how a breach at a subcontractor can expose information held by a public service even when the city’s own systems are not reported compromised. Osaka’s service depended on TKC, which in turn used Arara to send email. A security failure at that downstream provider affected addresses connected to a city system and disrupted its ability to send messages.
Email addresses can make recipients easier to target with convincing phishing messages, especially when attackers can imitate a public agency or refer to account activity. The city advises users to treat unexpected messages claiming to come from Osaka as suspicious, avoid entering passwords or payment-card details after following links, and verify information through the city’s website. This is a precaution, not evidence that the exposed addresses have been used for further attacks.
The figures also need careful interpretation. 1,078,713 is a count of email addresses, not a verified number of residents or unique people. One person may have more than one address, while the same address may be associated with more than one service or record. The city has not published a count of distinct individuals affected.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 24GB Memory, 1TB SSD, Midnight
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
How the Exposure Was Traced
Arara’s account, as summarized in company filings and TKC reports, places the unauthorized activity in late October. Arara recorded what it described as apparent reconnaissance on October 27. On October 28, an attacker accessed an administrative screen in a shared environment and copied data. Arara confirmed unauthorized access that day and said its service also began sending fraudulent credit-card emails.
Arara shut down the environment used for TKC’s local-government systems on October 31 at 17:37 Japan time, after finding that data had also been taken through its service. Osaka’s system could no longer send email from about 17:40. Arara completed a wider shutdown later that evening. The company’s November 6 report put the total number of addresses taken, after deduplication, at 81,329,467.
Osaka issued initial notices on November 3 and 4 as the scope was being assessed. On November 4, TKC told the city that only email addresses were affected. The city’s November 13 final report identified 1,078,713 addresses matching its users. This timeline distinguishes the period of unauthorized activity from the dates on which companies and the city disclosed findings.
“The email addresses of users of the system leaked to outside parties.”
— Osaka City, in its November 13 report
What the Public Record Does Not Establish
The city has not said how many unique people are represented by the 1,078,713 addresses, and it says it cannot verify whether a specific address was affected through individual inquiries. Its report defines the relevant group through emails sent during the stated period, but does not provide a public list of affected addresses.
Osaka says it is seeking a detailed account from TKC covering the cause, scope and steps to prevent a repeat. The information provided does not establish whether the stolen addresses have been used in targeted phishing or other follow-on activity. The city and providers say other categories of data were not exposed, but further technical findings or changes to that assessment have not been detailed in the supplied reports.
City Review and User Guidance
Osaka says it has asked TKC for a detailed report and will review how personal information is handled by external services, the safety measures applied to those services, and coordination among vendors. The city said individual notices to affected users were under consideration in its November 13 report; it did not announce a schedule for such notices.
For now, users should rely on the city’s official website rather than links in unexpected messages that claim to be from Osaka. The city’s published sender address for the affected system is info-osaka-online@city.osaka.lg.jp, but the appearance of a familiar sender name or address alone should not be treated as proof that a message is genuine. Further details depend on the reports Osaka has requested from TKC and any subsequent updates from the city or the companies involved.
Key Questions
What information did Osaka say was exposed?
Osaka says email addresses only were exposed. The city and TKC say email bodies, My Number data and application information were not leaked.
Does 1,078,713 mean that many people were affected?
No. The figure is a count of email addresses, not a confirmed count of unique individuals. Osaka has not published a total number of people affected.
Who may be included in Osaka’s count?
The city says the addresses were associated with people who received system emails between July 1 and October 31, 2026, including account, application and announcement messages. The city cited a notice sent to all registered users on September 16 as one reason the total is large.
Was Osaka City’s own system breached?
Osaka says it found no break-in to its own online system. The exposure occurred at Arara Message, an email delivery service used by TKC, the system provider.
What should recipients do about suspicious messages?
Osaka advises treating unexpected messages claiming to be from the city with caution, not entering passwords or card details through links in those messages, and checking information directly on the city’s official website.
Source: ThorstenMeyerAI.com
