🔍 Read the full analysis: Osaka Data Breach: A Practical Response To The 1.08 Million Address Leak on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka City confirmed on Nov. 13 that 1,078,713 email addresses associated with its online administrative system were exposed after an attacker accessed the email delivery service used by its software provider, TKC. The city and TKC say the leak involved addresses only, not message contents, My Number data or application information. People who received system emails from July through October should be alert to suspicious messages; the city says it cannot check individual addresses on request.
Osaka City confirmed on Nov. 13 that 1,078,713 email addresses associated with its administrative online system were exposed after an attacker accessed an email delivery service used by system provider TKC Corporation. The city says the incident did not expose message contents, Japan’s My Number personal identification data or application information; the breach occurred at the delivery service, not in the city’s system, according to the city and TKC.
The addresses belonged to people who received emails from Osaka’s online system between July 1 and Oct. 31, 2026. The messages covered account registration, email or password changes, logins, applications, application-status updates and city announcements. Osaka said the total is high in part because the system sent a notice to every registered user on Sept. 16. Anyone registered on that date should treat their address as potentially included, although the city has not published a count of affected individuals.
Osaka said it identified the addresses using information supplied by the service provider and matched by TKC. TKC reported receiving the exposed data from Arara Message on Nov. 4 and began sorting it by client and system. Arara has reported that 81,329,467 email addresses were taken across its service after duplicate addresses were removed. That figure covers the service’s wider client base, not Osaka residents alone; Arara said the data came from up to about 380 client companies and represents addresses, not a verified number of people.
The city advised users to treat unexpected messages claiming to come from Osaka as suspicious, avoid entering passwords or payment-card details through email links, and check information through the city’s website. Osaka said individual notifications to affected users were still under consideration. It also said it cannot respond to requests asking whether a particular address was included.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
How the Leak Affects Osaka Users
The exposure gives attackers a set of addresses linked to people who used a public service, creating a risk that they could send convincing impersonation or phishing emails. The source material does not establish that the stolen addresses have been used in targeted scams. Still, messages referring to applications, account access or city notices could appear credible to recipients, especially when the city system itself routinely sent such emails.
The incident also shows how a breach at a subcontracted service can affect a government system even when the agency and its primary software provider report no intrusion into their own environments. Osaka says it has asked TKC for a detailed account of the cause, scope and steps to prevent recurrence, and plans to review how personal information is handled by external services and how vendors coordinate security responses.
The reported count is a count of email addresses, not confirmed people. Some users may have more than one address, and the published material does not give a verified number of unique individuals affected. That distinction matters when describing the scale of the incident and when users try to determine their own exposure.
Products Worth Considering
eufy E25 Robot Vacuum and Mop with HydroJet Roller Mop, 20,000 Pa Suction
Roborock Q7 L5 Robot Vacuum and Mop Combo
Dyson V8 Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
Breach Traced to Email Vendor
The incident was traced to Arara Message, the email service TKC used to send messages for Osaka’s online system. In its account, Arara recorded apparent reconnaissance on Oct. 27 and unauthorized access to an administrative screen in a shared environment on Oct. 28. Arara said data was copied and that its service began sending fraudulent credit-card emails. The source material reports that Arara confirmed unauthorized access that day.
Arara’s reporting developed as it investigated the scope. It initially reported about 3.01 million addresses from one shared system on Oct. 29, then about 77 million addresses on Nov. 2, and a final figure of 81,329,467 after removing duplicates on Nov. 6. On Oct. 31, Arara shut down the environment used by TKC for local-government systems; Osaka’s system could no longer send email from about 5:40 p.m. Japan time, according to the supplied timeline. The entire Arara service was shut down later that evening.
Osaka issued its final report on Nov. 13, after earlier notices as the information changed. TKC first told the city that names and other details might have been affected, then reported on Nov. 4 that its investigation found only email addresses exposed. The city’s final account likewise identifies addresses as the leaked information. A date sometimes described as the attack date, Nov. 2, was the date of an Arara report; the reported activity took place from Oct. 27 through the Oct. 31 shutdown.
“Users’ email addresses, 1,078,713 records.”
— Osaka City, in its Nov. 13 notice, translated from Japanese
Questions About Individual Exposure
The city has confirmed the number of exposed address records, but it has not stated how many distinct people those records represent. The available information also does not identify which individual addresses were included, and Osaka says it cannot confirm exposure address by address. Although the city and TKC say only email addresses leaked, the supplied material does not provide an independent technical audit of that conclusion.
It is also unclear whether the stolen addresses have been used in further phishing or other fraud, or whether all affected users will receive direct notice. Osaka said individual notifications were under consideration and requested a detailed report from TKC on the cause, scope and safeguards. The final findings from that review were not included in the source material.
City Review and User Precautions
Osaka says it will examine the handling of personal information by external services, safety measures and coordination with vendors. It has asked TKC to provide a detailed report on what happened, how far the exposure reached and what measures will reduce the chance of a repeat. The city has not announced a deadline for that report or a date for deciding whether to notify users individually.
For now, people who received messages from info-osaka-online@city.osaka.lg.jp during the reported period should be cautious with unexpected emails that invoke city services. Avoid signing in or submitting payment information through links in unsolicited messages; instead, reach the city through its official website or a known contact route. The source material does not say that users need to change passwords because of this exposure, since the reported leaked data consists of email addresses rather than passwords.
Key Questions
What information did Osaka say was exposed?
The city says 1,078,713 email address records were exposed. It and TKC say email contents, My Number data and application information were not leaked.
Who may be affected?
The addresses were linked to people who received emails from Osaka’s administrative online system between July 1 and Oct. 31, 2026. The city cited a notice sent to all registered users on Sept. 16 as one reason the count is high. It has not published a count of unique people.
Did Osaka’s own system get hacked?
The city says it found no break-in to its online system, and TKC says its own systems were not the point of entry. The breach was traced to Arara Message, the email delivery service TKC used.
Can I ask the city whether my address was leaked?
Osaka says it cannot answer individual inquiries about whether a particular email address was affected. It said direct notification was still under consideration.
What should users do now?
Treat unexpected messages claiming to be from Osaka as suspicious. Do not enter passwords or card details through email links; check notices through the city’s official website or another trusted channel.
Source: ThorstenMeyerAI.com
