🔍 Read the full analysis: Could A Vendor’s Vendor Have Exposed Your Email In Osaka? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed after an attacker accessed Arara Message, an email service used by system provider TKC. The city and TKC say email content, My Number details and application data were not leaked; the number of affected people is unknown.
Osaka City said on November 13 that 1,078,713 email addresses linked to users of its administrative online system had been exposed after an attacker accessed Arara Message, an email delivery service used by the system’s provider, TKC Corporation. The city and TKC say the incident did not expose email contents, My Number details or application data; the number of individual people affected has not been established.
The city’s final report covers addresses that received messages from its online system between July 1 and October 31, 2026. Those messages included account registration and changes, login notifications, application updates and other announcements. Osaka said the total is high partly because the system sent a notice to all registered users on September 16. The city’s count refers to email addresses, not a confirmed count of people.
Osaka says it identified its users’ addresses using information supplied by TKC, which had received leaked data from Arara. TKC reported receiving the addresses from Arara on November 4 and began sorting them by customer and system. TKC and the city say only email addresses belonging to Osaka system users were affected. The city has asked TKC for a detailed report on the cause, scope and measures to prevent a recurrence.
Arara’s reported total is much larger: 81,329,467 email addresses, after duplicates were removed, across as many as about 380 client companies. Arara has said these are addresses, not a count of people. Osaka has not said how many of its 1,078,713 addresses belong to unique individuals, and says it cannot confirm whether a particular address was affected.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Why a Supplier Breach Reached City Users
The incident shows how a breach at a service provider further down the supply chain can expose contact information associated with a public service even when the city’s own system has not been reported compromised. Osaka says it has found no break-in to its online system, and TKC has said the same about its systems. The unauthorized access instead occurred at Arara, which handled email delivery for TKC.
For users, exposed addresses can make it easier for scammers to send messages that appear connected to city services. That possibility is a risk assessment, not evidence that Osaka users have already been targeted. The breach report does not establish that passwords, payment information or application records were taken. Still, people who received messages from the system during the stated period should be alert to unexpected emails claiming to be from the city, particularly messages asking them to follow a link or provide sensitive information.
The case also puts attention on oversight of external vendors. Osaka says it will review how personal information is handled by external services, safety measures and cooperation arrangements with vendors. The review matters beyond this incident because online public services depend on multiple organizations to manage systems and communications.
Popular right now
De'Longhi Magnifica Duo Fully Automatic Espresso Machine with Milk Frother, Silver
Hisense 55-Inch E6SR Series Hi-QLED 4K UHD Smart Roku TV (55E6SR, 2026 Model)
Dyson V9 Motorbar Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
How the Email Service Was Breached
According to reports from Arara, TKC and Osaka, the key activity took place in late October. Arara said it detected what appeared to be reconnaissance on October 27. On October 28, an attacker accessed an administrator screen in a shared environment and copied data. Arara confirmed unauthorized access that day. Its parent company, PayCloud Holdings, disclosed an initial figure of about 3.01 million addresses on October 29.
Arara later determined that the attacker had used its service between October 28 and 31 to access more servers and remove additional data. On October 31, Arara shut down the environment used by TKC for local-government systems; Osaka’s system then could no longer send email. Arara completed shutdown of its entire service that evening. Its later reports revised the total from about 77 million to 81,329,467 addresses, after duplicate records were removed.
Osaka issued initial updates on November 3 and 4 as the scope was still being reviewed. TKC told the city on November 4 that the affected information was limited to email addresses. Osaka’s November 13 report set the city-specific total at 1,078,713. The dates matter: November 2 was the date of one Arara report, not the date the reported unauthorized access began.
““The email addresses of users of the system leaked to outside parties.””
— Osaka City, in its November 13 report
Who Was Affected Remains Unclear
The confirmed Osaka figure is a count of email addresses, not people. A person may have had more than one address, and the city has not published a unique-user count. It also says it cannot tell individuals whether a specific address appears in the leaked data. Osaka said individual notices to affected users were under consideration, but had not announced a decision in its November 13 report.
The city and TKC say email bodies and other user data were not exposed, but the information available here does not include a full technical account of the attacker’s actions or independent verification of those limits. Osaka has requested a detailed report from TKC on the incident’s cause, scope and response. It is also not clear whether addresses from the Osaka system have been used in phishing or other follow-up activity. Arara’s total covers many clients, and the reported number alone does not show how many people, organizations or distinct users were affected.
City Awaits Vendor Findings
Osaka says it has asked TKC to provide a detailed account of what happened, what information was affected and how a repeat will be prevented. The city also plans to review its handling of personal information on external services, safety-management measures and coordination with vendors. It had not provided a completion date for that work in the November 13 report.
Whether the city will send individual notices remains open; it said those notices were under consideration. For now, users can treat unexpected messages claiming to come from Osaka City with care. The city’s advice is to avoid entering passwords or card details after following an email link and to check information through the city’s website instead. Further detail depends on the vendor reports and any additional updates from Osaka, TKC or Arara.
Key Questions
What information did Osaka say was exposed?
Osaka and TKC said email addresses only were affected. They said email contents, My Number details and application data were not exposed.
Does 1,078,713 mean that many people were affected?
No. The city’s figure is a count of email addresses. It has not published a count of unique individuals, and one person could have more than one address.
Who should be alert to suspicious emails?
The city’s report covers people whose addresses received messages from its online system between July 1 and October 31, 2026. Osaka says it cannot confirm whether an individual address was included.
Was Osaka City’s own system hacked?
The city says it found no break-in to its online system, and TKC said its systems were not compromised. The reported unauthorized access was at Arara Message, the email service TKC used.
What should users do if they receive an unexpected city email?
Do not enter passwords or card details after following a link in an unexpected message. Check claims through Osaka City’s website rather than relying on the email.
Source: ThorstenMeyerAI.com
