🔍 Read the full analysis: 1.08 Million Email Addresses Leaked In Osaka: A Guide To What To Do on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Osaka confirmed on November 13 that 1,078,713 email addresses linked to its administrative online system were exposed after a breach at Arara Message, an email delivery service used by system provider TKC. The city and TKC say the exposure was limited to email addresses; users should treat unexpected messages claiming to come from the city with caution.
Osaka confirmed on November 13 that 1,078,713 email addresses linked to users of its administrative online system were exposed after attackers accessed Arara Message, an email delivery service used by system provider TKC Corporation. The city and TKC say the leak involved email addresses only, not message contents, My Number identification numbers or application data.
The city says the affected addresses belong to people who received system emails between July 1 and October 31, 2026. Those messages covered account registration, email or password changes, logins, applications, application-status updates and announcements. Osaka attributed the large total in part to a notice sent to all registered users on September 16. The figure counts email addresses, not confirmed individual people; no count of affected people has been published.
Osaka said it identified its users’ addresses using information Arara supplied to TKC, which sorted and matched the data to customer systems. TKC said it received the leaked addresses from Arara on November 4 and began separating them by customer and system. The city said it has requested a detailed report from TKC on the cause, scope and steps to prevent a repeat.
The breach was at a vendor further down the service chain, rather than in Osaka’s own system, according to the city and TKC. Arara reported that attackers accessed an administration screen in a shared environment and copied data. The company’s November 6 report put the total taken from its service at 81,329,467 email addresses after removing duplicates, across as many as about 380 client companies. That broader vendor figure is not a count of Osaka users.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Risks for Osaka Service Users
The exposure gives scammers a way to target people with messages that appear connected to Osaka’s online services. Because affected addresses received system communications about applications and accounts, an unexpected message referring to one of those topics may seem credible. The city has advised users to be wary of emails claiming to come from it and to verify information through its website.
For readers, the distinction between an address leak and a leak of account credentials or application records matters. Osaka and TKC say the exposed information was limited to email addresses, but that does not make deceptive follow-up messages harmless. Users should not enter passwords or payment-card details after following an unsolicited link. The incident also shows how a breach at a service provider can affect public-sector users even when the government system itself is not reported to have been accessed.
Products Worth Considering
LG UltraGear 32GX870A-B 32-inch 4K UHD OLED Gaming Monitor
Amazon Kindle Scribe (32GB) with Premium Pen, Tungsten (Like-New)
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
How the Vendor Breach Reached Osaka
TKC provides the online system used by Osaka, and used Arara Message to deliver its emails. Osaka and TKC said they found no intrusion into their own systems. The reported access occurred at Arara, whose service was used by multiple customers. Arara’s reports describe activity beginning with apparent reconnaissance on October 27, followed by unauthorized access and data copying on October 28.
Arara shut down the environment used for TKC’s local-government systems on October 31; Osaka’s system then could not send email. Arara later increased its estimate of the total addresses taken as it examined the incident: its November 6 report gave the deduplicated total of 81,329,467. Osaka’s November 13 report specified the portion matched to its system. The city said it is reviewing how personal information is handled by outside services and how it coordinates with vendors.
“Users’ email addresses, 1,078,713 records.”
— City of Osaka, in its November 13 report
What the Reports Do Not Resolve
The city has not published a count of individual people affected, and its address total should not be read as a people count. Osaka also said it cannot confirm for individuals whether a particular address is included. Individual notifications are under consideration, but the city had not said whether or when they would be sent.
The city and TKC say email addresses were the only information exposed from Osaka’s system, while Arara’s broader incident affected data associated with many customers. The available reports do not establish that every address in Arara’s overall total was linked to a person or show the full consequences for all of its clients. Osaka has requested further reporting on the cause, scope and preventive measures.
Osaka Awaits Vendor Findings
Osaka says it has asked TKC for a detailed account of the incident and will review its handling of personal information in external services, its safety-management measures and its coordination with vendors. The city may also decide whether to notify affected users individually; it has described those notices as under consideration, not confirmed.
Until further details are published, users should check city-related information through Osaka’s official website rather than links in unexpected emails. The city’s next substantive update is likely to clarify the vendor findings, response measures and whether individual notices will be issued. No date for such an update has been announced in the material available.
Key Questions
What information was exposed?
Osaka and TKC say the exposure involved email addresses only. They say email contents, My Number identification numbers and application data were not leaked from the city’s system.
Who may be affected?
The city says the addresses were recipients of emails from its online system between July 1 and October 31, 2026. It cites a notice sent to all registered users on September 16 as one reason the total is high. Osaka has not published a count of individual people affected.
Does the 1,078,713 figure mean that many people were affected?
No. It is the number of email addresses Osaka matched to its system. The city has not provided a separate count of people, and the published information does not establish how many distinct individuals those addresses represent.
What should users do if they receive an email claiming to be from Osaka?
Treat unexpected messages with caution. Do not enter a password or payment-card details after clicking an email link; instead, check information through Osaka’s official website. The city says it cannot confirm whether an individual address was affected.
Source: ThorstenMeyerAI.com
