🔍 Read the full analysis: Vendor’s Vendor, 1.08 Million Emails: The Osaka Breach In Brief on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Osaka confirmed on November 13 that 1,078,713 email addresses linked to its administrative online system were exposed after an attacker accessed Arara Message, an email delivery service used by system provider TKC. The city and TKC say the breach involved email addresses only; they say messages, My Number details and application data were not leaked.
Osaka confirmed on November 13 that 1,078,713 user email addresses associated with its administrative online system were exposed after an attacker accessed Arara Message, an email delivery service used by system provider TKC Corporation. The city says it has found no break-in to its own system, and TKC says its systems were not the point of entry; the breach occurred farther down the vendor chain.
The exposed addresses belong to people who received email from the system between July 1 and October 31, 2026. Messages covered account registration and changes, logins, applications, application status updates and announcements. Osaka says the total is high partly because the system sent a notice to all registered users on September 16. The count is for email addresses, not verified individual people; the city has not published a count of affected people.
Osaka and TKC say the information exposed was limited to email addresses. They say the contents of emails, Japan’s My Number personal identification details and application data were not leaked. The city says it matched information supplied by Arara with system records to identify addresses connected to Osaka’s service. TKC says it received the leaked data from Arara on November 4 and began sorting it by client and system.
Arara reported that 81,329,467 email addresses were taken across its service after duplicate records were removed. The company said the data came from as many as about 380 client companies and described the total as addresses, not people. Arara’s figures cover the wider incident, not just Osaka. The city has asked TKC for a detailed account of the cause, scope and steps to prevent a recurrence.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
How the Vendor Chain Expanded Exposure
The incident shows how a public service can be affected even when its own systems are not identified as the breach entry point. Osaka relied on TKC for its online system, and TKC relied on Arara for email delivery. A compromise at that downstream service exposed addresses linked to communications from a municipal system, putting people at risk of targeted fraudulent messages that appear to come from the city.
The confirmed data type limits what can be concluded about the incident: Osaka and TKC say addresses alone were exposed, not application records or identification details. But email addresses can still help scammers make messages seem credible. Osaka advises users to treat unexpected messages claiming to be from the city with suspicion, avoid entering passwords or payment-card details through links, and consult the city’s website directly.
The case also raises questions about how agencies evaluate and monitor external providers that handle personal information. Osaka says it will review its handling of personal information in external services, safety management and vendor cooperation. The review matters beyond this breach because the city uses outside companies as part of the service chain, while residents may reasonably see the service as a city operation.
Products Worth Considering
Amazon Kindle Paperwhite (12th Generation, 2024), 16GB, 7-Inch Display, Raspberry
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Apple Watch Series 12 GPS 42mm
As an affiliate, we earn on qualifying purchases.
From October Access to City Confirmation
According to the incident timeline described by Arara, TKC and Osaka, Arara’s service was briefly taken offline on October 22 in response to a PHP vulnerability. Arara later recorded activity it characterized as reconnaissance on October 27. On October 28, an attacker accessed an administrator screen in a shared environment and copied data. Arara also said its service began sending fake credit-card emails that day.
Arara confirmed unauthorized access on October 28. It initially reported about 3.01 million addresses from one shared system, then expanded its estimate as it identified data removed through the service. On October 31, Arara shut down the environment TKC used for local-government systems; Osaka’s system could no longer send email from about 17:40 Japan time. Arara completed shutdown of its entire service later that evening.
TKC told Osaka on October 30 that it had been informed there was no information leak from TKC’s usage environment. As Arara’s investigation developed, TKC notified the city that customer information might be affected. Osaka issued initial notices on November 3 and 4, then published its final count on November 13 at 13:00 Japan time. The dates matter: November 2 was the date of an Arara report, not the date of the attack described in the company’s timeline.
“Users’ email addresses, 1,078,713 records.”
— Osaka City, in its November 13 notice
Individual Exposure Remains Unverified
Osaka has not said whether it will notify each affected user individually; its notice says that option is under consideration. The city also says it cannot answer requests to confirm whether a specific address was included. Although it defines the relevant group by emails sent during the July-to-October period, it has not provided a public list or a person-level count.
The city says the leaked information was email addresses only, based on information passed from Arara to TKC and then matched to Osaka’s records. Its request for a detailed report from TKC indicates that the investigation and review of the incident are continuing. The source material does not provide a completed independent audit of the breach or a final account of how the attacker first gained access.
Arara’s overall figure is also distinct from the Osaka total: it covers addresses taken from its service across many clients. The available reporting does not establish how many of those records correspond to unique people, whether addresses were reused across clients, or whether any exposed Osaka addresses have since been targeted in scams.
City Seeks Vendor Findings and Review
Osaka says it has asked TKC to provide a detailed report on the breach’s cause, scope and measures to prevent a repeat. It also says it will review how external services handle personal information, the safety measures applied to those services and how the city coordinates with vendors. The city has not announced a deadline for publishing those findings.
Users who received mail from info-osaka-online@city.osaka.lg.jp between July 1 and October 31 should be alert to unexpected messages that claim to be from Osaka. The city advises people not to follow suspicious links or enter passwords or card details after clicking one, and to check information through the city’s website. These precautions are general advice; the city has not said that a particular follow-up scam has been confirmed.
Further public updates may clarify whether Osaka will contact users directly and what changes TKC, Arara or the city will make. Until then, the confirmed scope remains the city’s count of 1,078,713 email addresses and the companies’ statements that other listed data types were not exposed.
Key Questions
What information did Osaka confirm was exposed?
Osaka confirmed that 1,078,713 email addresses linked to its administrative online system were exposed. The city and TKC say email contents, My Number details and application data were not leaked.
Who may be affected?
The city defines the relevant addresses as those that received system emails from July 1 through October 31, 2026. It says the September 16 message to all registered users contributed to the large total. The count is addresses, not a confirmed number of people.
Was Osaka City’s own system breached?
The city says it has found no break-in to its online system, and TKC says its systems were not the point of entry. The breach occurred at Arara Message, the email delivery service used by TKC.
How many addresses were involved across Arara’s service?
Arara reported 81,329,467 addresses after removing duplicates, across its wider service and up to about 380 client companies. That figure is not the Osaka-only total and does not establish how many individual people were affected.
Can residents ask Osaka whether their address was exposed?
Osaka says it cannot answer inquiries about individual addresses. The city says individual notifications are under consideration and advises users to be cautious with unexpected messages claiming to come from Osaka.
Source: ThorstenMeyerAI.com
