🔍 Read the full analysis: Osaka Data Breach: Why A Vendor’s Vendor Matters on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed after a breach at Arara Message, an email service used by its provider, TKC. The city and TKC say the exposed information was limited to email addresses; email contents, My Number data and application records were not leaked. The number counts addresses, not confirmed individual people.
Osaka confirmed November 13 that 1,078,713 email addresses linked to its administrative online system were exposed after attackers accessed Arara Message, an email delivery service used by system provider TKC Corporation. The city says it found no intrusion into its own system, and TKC says the breach occurred at the downstream service rather than in TKC’s environment.
The city’s final report identifies addresses belonging to recipients of system emails sent from July 1 through October 31, 2026. Those messages included account registration and changes, password changes, login notices, applications, application-status updates and general announcements. Osaka said the total is high partly because the system sent a notice to all registered users on September 16. The city’s figure is a count of email addresses, not confirmed people; no count of distinct affected individuals has been published.
Osaka says the exposed information was limited to email addresses. The city and TKC say email message contents, Japan’s My Number personal identification number and application data were not leaked. The city matched addresses supplied by TKC against its system records. TKC said it received the leaked data from Arara on November 4 and began sorting it by customer and system that day.
Arara reported that 81,329,467 addresses in total were taken from its service after duplicate entries were removed. The company said the data involved as many as about 380 client companies. That broader total is not a count of affected people, and Osaka’s figure is the subset the city says was associated with its system.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Why a Mailing Vendor Matters
The incident shows how a public-facing service can be affected through a vendor several steps down the supply chain. Osaka says its own system was not breached, but email addresses used by that system were exposed because TKC relied on Arara to deliver messages. The result is a privacy incident for city-service users even though the reported point of access was outside the city’s systems.
Email addresses alone are not the same as passwords or application records, and the city says those more sensitive categories were not exposed. But an address linked to contact with a government service could make an unexpected message appear credible. Users should be alert to emails impersonating Osaka or its online system, especially messages urging them to follow a link or provide credentials or payment-card information. The source material does not establish that the stolen Osaka addresses have been used in a phishing campaign.
The case also puts attention on how organizations review external services that handle personal information. Osaka says it will re-examine its handling of information by outside services, safety measures and coordination with vendors. Those reviews matter because a customer’s security depends partly on the controls and incident reporting of providers it may not interact with directly.
Popular right now
Ninja CREAMi 7-in-1 Ice Cream Maker, NC301
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
Ninja CREAMi Scoop & Swirl 13-in-1 Ice Cream and Soft Serve Maker (NC701)
As an affiliate, we earn on qualifying purchases.
How the Breach Reached Osaka
Arara Message was the email delivery service used by TKC Corporation, provider of Osaka’s administrative online system. According to the incident timeline in the supplied reports, Arara briefly took the service offline on October 22 to respond to a PHP vulnerability. Arara later recorded apparent reconnaissance on October 27 and unauthorized access to an administrative screen in a shared environment on October 28, followed by data copying. These are details attributed to Arara’s reporting, not findings independently established in the supplied material.
Arara confirmed unauthorized access on October 28. It shut down the environment used for TKC’s local-government systems on October 31, after finding that data had also been carried out through its service. Osaka’s system then could no longer send email. Arara completed the shutdown of its wider service later that day. Its reports put the address total at about 3.01 million on October 29, about 77 million on November 2, and 81,329,467 after deduplication in a November 6 report.
Osaka issued its final report on November 13 at 1 p.m. Japan time. Earlier notices described the scope as potentially including names and other details; TKC told Osaka on November 4 that only email addresses were affected. The final city figure followed the provider’s review and matching of the data.
““Because a notice email was sent from the system to everyone registered as a user on Wednesday, September 16, 2026, the number is very large.””
— City of Osaka, explaining the size of its count
What the Reports Do Not Resolve
The city has confirmed the number of address records associated with its system, but the number of individual people affected is unknown. An address count does not establish how many unique users were involved, and the city says it cannot confirm whether a particular address is included. The supplied source material also does not say whether Osaka has completed the review needed to identify every affected user.
Osaka said individual notices were under consideration and requested a detailed report from TKC on the cause, scope and measures to prevent a repeat. The material does not provide the completed findings of that report or a full technical account of how access was obtained. It also does not establish whether attackers have used the Osaka-related addresses beyond the data theft described in the reports.
The distinction between the reported incident dates and later reporting dates matters: November 2 was the date of Arara’s second report, while the activity described in the timeline ran from October 27 through the October 31 shutdown. The available material does not support describing November 2 as the date the breach itself occurred.
City and Vendor Reviews Ahead
Osaka says it has asked TKC for a detailed account of the incident, including its cause, scope and steps to prevent a recurrence. The city also says it will review how external services handle personal information, its safety-management measures and its coordination with vendors. The supplied reports do not give a deadline for those reviews or say when their results will be released.
Individual notifications remain under consideration, and the city says it cannot answer whether a specific address was affected. Until it provides further guidance, users should treat unexpected messages claiming to be from Osaka City with care: avoid entering passwords or card details after following an email link, and consult information on the city’s website directly. Further clarity depends on the city’s review and any additional reporting from TKC and Arara.
Key Questions
What information does Osaka say was exposed?
The city and TKC say the exposed information was email addresses only. They say email contents, My Number data and application information were not leaked.
Does 1,078,713 mean that many people were affected?
No. It is the reported number of email addresses associated with the city system. The number of distinct people has not been published.
How did a breach at Arara affect Osaka users?
TKC, the provider of Osaka’s online system, used Arara Message to deliver email. The city says addresses from its system were among data exposed through unauthorized access to that downstream service.
Can Osaka tell users whether their address was included?
The city says it cannot answer inquiries about individual addresses. It said individual notifications were under consideration, but the supplied reports do not confirm that they will be sent.
What should users do about emails claiming to be from Osaka?
Treat unexpected messages cautiously. Do not enter passwords or payment-card details after clicking an email link; check information through Osaka City’s website instead.
Source: ThorstenMeyerAI.com
