🔍 Read the full analysis: How A Vendor’s Vendor Led To The Osaka Email Address Breach on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed after attackers accessed Arara Message, an email service used by system provider TKC. The city and TKC say the exposed information was limited to email addresses; they say email contents, My Number data and application records were not leaked.
The City of Osaka confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system had been exposed in a breach at Arara Message, an email delivery service used by system provider TKC Corporation. Osaka and TKC say they found no intrusion into their own systems and that the exposed information was limited to email addresses, not email contents, My Number data or application records.
The city’s final report identifies the affected addresses as recipients of messages sent through the system between July 1 and October 31, 2026. Those messages covered account registration, email-address and password changes, logins, applications, application-status updates and city announcements. Osaka said the count was particularly high because the system sent a notice to all registered users on September 16. Anyone registered then should treat their address as potentially included, though the city says it cannot confirm whether a particular address was affected.
According to the city, the list was determined using information supplied by the external service provider to TKC, which sorted and matched the addresses against its customers’ systems. TKC said it received the exposed data from Arara on November 4 and began separating it by customer and system that day. Osaka’s figure is a count of email-address records, not a confirmed count of distinct people; the city has not published a number of affected individuals.
Arara said its investigation found 81,329,467 email addresses taken across its service after duplicate entries were removed. It said the data came from as many as about 380 client companies and cautioned that the total represents addresses, not people. Osaka’s addresses are part of that wider incident. The city says it has asked TKC for a detailed report on the cause, the affected data and steps to prevent a repeat.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
How the Vendor Chain Exposed Addresses
The incident shows how a breach at a subcontractor several steps down a service chain can expose contact information connected to a public system even when the city and its direct software provider report no compromise of their own environments. Osaka residents may receive messages that imitate city notices, making the exposure relevant beyond the number of records involved.
An exposed email address alone does not establish that an account was accessed or that identity information was stolen. However, attackers can use addresses to send targeted phishing messages, including fake notices about applications, passwords or payments. The city’s guidance is to treat unexpected messages claiming to be from Osaka as suspect, avoid entering passwords or card details through links in them, and check information through the city’s website.
The broader count reported by Arara also illustrates why a vendor’s aggregate figure should not be read as a count of people. An individual may have more than one address, and the reports do not establish how many unique people are represented. For affected users, the city’s account currently identifies email addresses as the exposed data, while leaving the exact number of people and any downstream misuse unconfirmed.
Products Worth Considering
Apple MacBook Pro 14.2-inch with Tandem OLED Display, Space Black
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
LG UltraGear 24-Inch Full HD IPS Gaming Monitor, 120Hz (144Hz Overclocked), 1ms MBR, G-SYNC Compatible, FreeSync, HDR10
As an affiliate, we earn on qualifying purchases.
From Arara Access to Osaka’s Report
Arara’s account places the intrusion in late October, rather than on November 2, a date that appeared in some early coverage as the attack date. The company described apparent reconnaissance on October 27. On October 28, it said, an attacker accessed an administrative screen in a shared environment and copied data. Arara also reported that its service began sending fake credit-card messages. It confirmed unauthorized access that day.
Arara’s parent company, PayCloud Holdings, disclosed an initial estimate of about 3.01 million addresses on October 29. Arara later reported that data had also been taken through its service, which the attacker used to access additional servers. On October 31, Arara shut down the environment used by TKC for local-government systems; Osaka’s system then became unable to send email. Arara said it completed the shutdown of its full service that evening.
Arara’s reported total rose as its investigation developed: about 77 million addresses on November 2, then 81,329,467 after deduplication in a November 6 update. TKC initially warned Osaka that addresses, names and other details might have been exposed. On November 4, it told the city that its review found only email addresses affected. Osaka published initial notices on November 3 and 4, followed by the final report on November 13.
“Users’ email addresses, 1,078,713 records.”
— City of Osaka, November 13 report
People, Misuse and Individual Notices
The reports do not establish how many unique people are represented by Osaka’s 1,078,713 address records, or whether any of the exposed addresses have since been used in phishing or other fraud. The city says email contents, My Number information and application data were not leaked, based on its and TKC’s findings; the available reporting does not independently establish what may have happened to the addresses after they were copied.
Osaka has said it cannot answer inquiries about whether an individual address is affected. It said individual notifications are under consideration, rather than confirming that notices will be sent. The city has requested a fuller account from TKC, including the cause, scope and prevention measures. The source material does not provide the full technical explanation of the vulnerability or confirm a final remediation assessment across all affected systems.
Osaka Reviews Vendor Safeguards
Osaka says it will examine how personal information is handled by external services, the safety measures in place and how the city coordinates with vendors. It has also asked TKC for a detailed report on the incident and measures intended to prevent a recurrence. The timing and contents of any additional public report have not been specified.
For users, the city’s current advice is to be cautious with unexpected messages that appear to come from Osaka and to verify notices on the city’s website rather than through links in an email. The city has not said whether it will send individual breach notices, and it has not published a way for users to check their address against the affected list.
Key Questions
What information did Osaka say was exposed?
The city and TKC say the exposed information was email addresses only. They say email contents, My Number data and application records were not leaked.
Who may be affected by the Osaka breach?
The city says the addresses belonged to recipients of system emails sent between July 1 and October 31, 2026. It cited a message to all registered users on September 16 as a major reason for the large count. Osaka cannot confirm whether a specific address was affected.
Was the Osaka city system itself hacked?
Osaka says it found no intrusion into its online system. TKC also said no breach was found in its own systems; the reported access occurred at Arara Message, the email delivery service TKC used.
How many people were affected?
The city confirmed 1,078,713 email-address records, not a count of unique people. Neither Osaka nor the cited reports have published a number of distinct individuals represented.
What should recipients do about unexpected Osaka emails?
Osaka advises treating unexpected messages claiming to come from the city as suspect. Do not enter passwords or payment-card details through an email link; check information through the city’s website instead.
Source: ThorstenMeyerAI.com
