🔍 Read the full analysis: What Should You Do About The Osaka Email Address Leak? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka confirmed on November 13 that 1,078,713 email addresses associated with its online administrative services were exposed in a breach at Arara Message, an email delivery service used by its provider, TKC. The city and TKC say the exposed information was limited to email addresses, not message contents or application data. People who received system emails from July through October should treat unexpected messages claiming to be from the city with caution.
Osaka confirmed on November 13 that 1,078,713 email addresses linked to users of its administrative online system were exposed after an attacker accessed Arara Message, an email delivery service used by system provider TKC Corporation. The city and TKC say the leak involved email addresses only; they have not reported exposure of message contents, My Number identification details or application data.
The city said the affected addresses belong to recipients of system emails sent between July 1 and October 31, 2026. Those messages covered account registration, email address or password changes, logins, applications, application status updates and announcements. Osaka explained that the total is high partly because the system emailed all registered users on September 16. Anyone who had an account then should treat their address as potentially included, although the city says it cannot confirm the status of a particular address.
The breach occurred at Arara Message, which TKC used to deliver emails for the city’s system. Osaka said its own system was not found to have been breached, and TKC reported no unauthorized access to its own usage environment. Arara reported that 81,329,467 email addresses were taken across its service after duplicate records were removed. That broader total covers data associated with up to about 380 client companies; it is a count of addresses, not a confirmed count of people.
Osaka said it identified its addresses using information Arara provided to TKC, which sorted and matched the data to customer systems. TKC received the leaked address data from Arara on November 4 and began sorting it that day, according to the source reports. The city has asked TKC for a detailed account of the cause, scope and steps to prevent a repeat. It said individual notices to affected users are still under consideration.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
How the Leak Raises Phishing Risk
An exposed email address can make it easier for criminals to send convincing messages that imitate a public agency, even when other account information was not reported exposed. For Osaka service users, the practical concern is targeted phishing: an unexpected message may refer to an application, account or city procedure and urge the recipient to click a link or provide information.
The city’s finding that it has not identified a breach of its own system does not remove that risk. The incident shows how a vendor used to deliver routine notices can become a route through which contact information is exposed. The reported scope also spans a large number of Arara clients, but the company’s total is email addresses, not people, and should not be described as a count of unique individuals.
People should be wary of messages asking for passwords, payment-card details or other sensitive information through a link. They can instead open the city’s website directly or use contact details they already trust to check whether a notice is genuine. This is a precaution, not evidence that every message from the city is fraudulent.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
LG UltraGear 24-Inch Full HD IPS Gaming Monitor, 120Hz (144Hz Overclocked), 1ms MBR, G-SYNC Compatible, FreeSync, HDR10
As an affiliate, we earn on qualifying purchases.
How the Vendor Breach Unfolded
Arara’s reports place the activity in late October. It recorded apparent reconnaissance on October 27 and said an attacker accessed an administrator screen in a shared environment and copied data on October 28. Arara confirmed unauthorized access that day. Its listed parent company, PayCloud Holdings, disclosed an initial total of about 3.01 million addresses on October 29.
Arara later determined that data had also been taken through its service as the attacker used it to reach additional servers. On October 31, Arara shut down the environment used by TKC for local-government systems; Osaka’s system then could not send email. Arara reported shutting down its full service that evening. Its November 2 report put the broader number at about 77 million addresses, and its November 6 report gave a total of 81,329,467 after deduplication.
Osaka issued earlier notices as information developed. On November 2, TKC told the city that names and other details might have been exposed and cited a possible scope across its customers. On November 4, TKC reported that the Osaka-related information at issue was limited to email addresses. The city’s November 13 report set the Osaka count at 1,078,713 addresses.
““Users’ email addresses, 1,078,713 records.””
— City of Osaka, in its November 13 report
What Users Still Cannot Verify
Osaka has not published a person-by-person list of affected users and says it cannot answer inquiries about whether a specific email address was included. Its total is a count of addresses, and the number of distinct people represented has not been reported. The city says it is considering whether to send individual notices.
The reported scope is limited to email addresses, based on Osaka and TKC’s current findings. The city has asked TKC for a detailed report on the cause, full scope and prevention measures, so further information may follow. The available reports do not establish that every address was misused, nor do they confirm that any specific user has received a scam as a result.
City Review and User Notices
Osaka says it has requested a detailed report from TKC and will review its use of outside services, information-security measures and coordination with vendors. The city has not set out a timeline for those reviews or confirmed whether affected users will receive individual notifications.
For now, users who received Osaka system emails during the stated period should treat unexpected messages claiming to come from the city cautiously. Avoid entering credentials or payment information through links in unsolicited messages, and check notices by visiting the city’s official website directly. Watch for further announcements from Osaka about notifications and the results of its vendor review.
Key Questions
Were passwords or application details exposed?
The city and TKC say only email addresses were affected. They have not reported exposure of email contents, My Number details or application data in this incident.
Who should treat their address as potentially affected?
Osaka says the affected addresses were recipients of system messages sent from July 1 through October 31, 2026. The city notes that it emailed all registered users on September 16, so people with an account on that date should assume their address may be included.
Can I ask Osaka whether my address was leaked?
The city says it cannot confirm exposure for individual email addresses. It is considering whether to contact users directly, but has not confirmed that individual notices will be sent.
What should I do if I receive a message claiming to be from Osaka?
Be cautious with unexpected messages, especially those that ask you to click a link or provide a password or card details. Check information through the city’s official website or trusted contact channels rather than using links in the message.
Does the 81.3 million figure mean that many people were affected?
No. Arara reported 81,329,467 email addresses across its service after removing duplicates. The number of distinct people represented has not been published, and the total includes data associated with multiple client companies.
Source: ThorstenMeyerAI.com
