🔍 Read the full analysis: Email Exposure In Osaka: What Affected People Should Know on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka City confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed after an attacker accessed email service Arara Message, used by system provider TKC. The city and TKC say the exposure was limited to email addresses; no individual address lookup is available, and the number of affected people has not been established.
Osaka City confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed in a breach of Arara Message, an email delivery service used by the system’s provider, TKC Corporation. The city and TKC say the exposed data was limited to email addresses, leaving affected users at risk of targeted or deceptive messages but not, according to their findings, exposure of application records or Japan’s My Number personal identification data.
The city’s final report says the affected addresses belonged to recipients of emails sent by the online system from July 1 through October 31, 2026. Those messages covered account registration, email or password changes, logins, applications, application-status updates and city announcements. Osaka said the count is high partly because the system sent a notice to every registered user on September 16. The city’s report identifies email addresses, not unique individuals; the number of people affected has not been published.
Osaka said it identified its users’ addresses using information supplied by TKC, which sorted and matched data provided by Arara. TKC reported receiving the exposed-address information from Arara on November 4 and began separating it by customer and system that day. The city said the addresses were associated with its service because the attackers accessed the email provider’s environment, not because investigators had found a break-in to Osaka’s online system.
Arara has reported a wider breach involving 81,329,467 email addresses after removing duplicates, drawn from as many as about 380 client companies. The company has emphasized that this is a count of addresses, not people. Osaka’s figure is one service-specific total within that larger incident. The city said it cannot confirm whether a particular address is included and that individual notices to affected users were still under consideration.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Why Exposed Addresses Matter
An email address alone does not provide access to an account, but exposure can make it easier for criminals to send messages that imitate a city, a service provider or another organization. Since the leaked addresses were tied to an administrative online system, an unexpected message about a login, application or account change may appear relevant to its recipient. That connection can make fraudulent links or requests for information harder to spot.
Osaka’s finding that email addresses only were exposed narrows the confirmed scope of the incident. It does not establish that every message claiming to relate to the breach is legitimate, nor does it mean passwords, payment details or application information were obtained. Residents should treat unexpected requests for passwords, card information or other personal data with caution and verify claims through the city’s official website rather than links in unsolicited emails.
Products Worth Considering
LG UltraGear evo 27-inch 5K Mini-LED Gaming Monitor
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels
As an affiliate, we earn on qualifying purchases.
How the Breach Reached Osaka Users
The incident occurred in the vendor chain used to send the city’s emails. TKC provides Osaka’s online system and used Arara Message for email delivery. Osaka and TKC have said they found no intrusion into their own systems; the confirmed access was at Arara. That distinction identifies where the exposure was traced, while leaving responsibility for any broader security findings to the companies’ investigations and the city’s review.
According to TKC’s account, Arara’s service was briefly taken offline on October 22 in response to a PHP vulnerability. Arara later described apparent reconnaissance on October 27 and unauthorized access to an administrative screen in a shared environment on October 28, followed by data removal. On October 31, Arara shut down the environment used for TKC’s local-government systems, and Osaka’s system could no longer send email from about 17:40 Japan time. Arara completed the shutdown of its service that evening.
Arara’s reporting on the scale changed as its investigation proceeded: it initially reported about 3.01 million addresses from one shared system, then about 77 million taken through its service, and on November 6 gave the total of 81,329,467 addresses after deduplication. Osaka published earlier notices on November 3 and 4 before confirming its service-specific count in the final report on November 13.
“It has been confirmed that the email addresses of users of the system leaked to outside parties.”
— Osaka City, in its November 13 report, translated from Japanese
What the City Has Not Confirmed
The number of affected people is unknown. The confirmed totals count email addresses, and the source material does not establish how many belong to distinct individuals or whether any person had more than one address included. Osaka has not released a public tool for checking an individual address and says it cannot answer individual inquiries about inclusion.
The city and TKC say email addresses were the only Osaka-system data exposed. The available reports do not establish whether exposed addresses have since been used in scams or other misuse, or whether all affected users will receive direct notification. Osaka said individual notices were under consideration and requested a more detailed report from TKC on the cause, scope and steps to prevent recurrence. Those reviews were not described as complete in the November 13 report.
City Reviews Vendors and Notifications
Osaka said it has asked TKC for a detailed account of the incident, including its cause, the scope of the exposure and measures to prevent a similar event. The city also said it will review how external services handle personal information, the safety measures applied to those services and how it coordinates with vendors. It had not announced a completion date for that review.
Whether the city will contact users individually remained under consideration as of November 13. Until it provides further information, people who used Osaka’s online services should rely on notices posted on the city’s official website, be wary of unexpected messages claiming to be from the city and avoid entering passwords or card details after following an email link. The available information does not provide a confirmed schedule for further reports or user notifications.
Key Questions
What information did Osaka say was exposed?
Osaka and TKC said the exposed information was email addresses only. They said email contents, My Number data and application information were not leaked in this incident.
Who should treat their address as potentially affected?
The city says the addresses were recipients of messages from its online system between July 1 and October 31, 2026. It also said a notice went to all registered users on September 16. The city has not published an individual address-checking service.
How many people were affected?
Osaka confirmed 1,078,713 email addresses, not 1,078,713 people. The number of distinct individuals has not been published.
What should I do if I receive an email claiming to be from Osaka City?
Be cautious with unexpected messages, particularly those asking for passwords, payment information or other personal details. Do not use a link in a suspicious email to sign in; check relevant information through Osaka City’s official website.
Will Osaka tell each affected user?
As of November 13, the city said individual notifications were under consideration. It also said it cannot confirm whether a particular email address is included in the leak.
Source: ThorstenMeyerAI.com
