🔍 Read the full analysis: What To Do If Your Email Was Exposed In The Osaka Data Breach on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka City confirmed on November 13, 2026, that 1,078,713 email addresses associated with its administrative online system were exposed after an attacker accessed the email service Arara Message, used by system provider TKC. The city and TKC say the confirmed exposed information was email addresses, not message contents, My Number data or application records; users should treat unexpected messages claiming to be from the city with caution.
Osaka City said on November 13, 2026, that 1,078,713 email addresses linked to its administrative online system were exposed after an attacker accessed Arara Message, an email delivery service used by system provider TKC. The city and TKC say the confirmed leak involved email addresses only, but users who received system emails should be alert to suspicious messages claiming to come from Osaka.
The city says the affected addresses belong to recipients of messages sent by its system from July 1 through October 31, 2026. Those messages included account registration and changes, login notices, applications, application-status updates and announcements. The total is large in part because the system sent a notice to all registered users on September 16, according to the city. The figure counts email addresses, not confirmed individual people; no count of affected people has been published.
The breach took place at Arara Message, which TKC used to deliver emails for the city’s online system. Arara reported that a total of 81,329,467 email addresses were taken across its service, after duplicate addresses were removed. The company said the data came from as many as about 380 client companies; that broader figure is not the number of Osaka users affected.
Osaka says it identified its users’ addresses using information Arara provided to TKC, which sorted and matched the data. TKC told the city on November 4 that only email addresses were affected. The city and provider say email contents, My Number personal identification numbers and application data were not leaked. The city has not said that it can check whether any particular person’s address was affected.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
How the Leak Could Affect Users
The exposed information does not, according to the city and TKC, include passwords, message contents or application records. Even so, an email address tied to use of a government service can make a convincing target for phishing attempts. A fraudulent message could claim there is a problem with an application or account and try to persuade a recipient to share credentials or payment information.
People who received Osaka system emails during the stated period should treat unexpected messages claiming to be from the city with care. Do not enter a password, payment-card details or other sensitive information after following an email link. Instead, open the city’s official website directly and check for information there. These steps reduce exposure to impersonation attempts; they do not establish whether a particular address was among those taken.
The incident also highlights a point for users: services may rely on outside companies to send routine messages. Osaka says its own online system was not found to have been breached, and TKC says the same of its systems. The confirmed access was further down that delivery chain, at Arara, rather than in the city system itself.
Products Worth Considering
Dell UltraSharp U4025QW 40 5K2K WUHD Curved LED Monitor (21:9)
Apple Mac mini Desktop Computer with M6 Chip (2026)
Canon SELPHY CP1500 Compact Photo Printer Bundle with Ink and Paper Set, White
As an affiliate, we earn on qualifying purchases.
From Service Shutdown to City Report
Arara’s incident timeline, as summarized in company filings and TKC reports, places the activity in late October. Arara recorded apparent reconnaissance on October 27 and said an attacker accessed an administrative screen in a shared environment and copied data on October 28. It confirmed unauthorized access that day. Arara later said the attacker used its service to reach additional servers between October 28 and 31.
On October 31, Arara shut down the environment used by TKC for local-government systems. Osaka’s system could no longer send email from about 5:40 p.m. Japan time, according to the supplied account of the incident; Arara completed the shutdown of its service later that evening. TKC received a report on October 30 that there had been no leak from its own usage environment, but Arara subsequently found that data had also been taken through its service.
Arara’s estimates changed as its investigation progressed: an initial disclosure cited about 3.01 million addresses from one shared system; a later report put the number at about 77 million, and its November 6 report gave the final total of 81,329,467 addresses after duplicates were removed. Osaka published earlier updates before confirming its own affected-address count on November 13.
“Users’ email addresses, 1,078,713 records.”
— Osaka City, in its November 13 report, translated from Japanese
Individual Exposure Remains Unverified
The city’s total is a count of email addresses, not people, and it has not published a count of unique individuals affected. Because the city says it cannot answer inquiries about individual addresses, users currently have no confirmed city-provided way to check whether a specific address was included.
The city says it has asked TKC for a detailed account of the cause, the scope and steps to prevent a recurrence. Its report says email bodies and application information were not leaked, based on information from TKC and the investigation described so far. Further findings could clarify how the attacker accessed Arara’s systems and whether additional details affect the account of the incident. No evidence in the supplied reports establishes that the exposed addresses have been used in a particular phishing campaign.
City and Provider Investigations Continue
Osaka says it is considering whether to contact affected users individually. It has also requested a detailed report from TKC and said it will review how personal information is handled by external services, the safety measures in place and coordination with vendors. The city has not announced a date for those steps or for any further public report.
For now, users can follow the city’s published updates and verify account or application information by visiting its official site directly. A message that appears to come from Osaka is not proof that it is genuine. Do not use links in unexpected emails to sign in or provide sensitive details, and report suspicious messages through the appropriate official channels if the city provides them.
Key Questions
Was my Osaka City email address exposed?
The city confirmed that 1,078,713 email addresses associated with its online system were exposed. It says it cannot answer whether an individual address was included, so there is currently no city-provided individual confirmation.
What information does Osaka say was leaked?
Osaka and TKC say the confirmed exposed data was email addresses only. They say email contents, My Number data and application information were not leaked.
Which users may be affected?
The city’s count covers recipients of emails sent by its system between July 1 and October 31, 2026. The city says a notice sent to all registered users on September 16 contributed to the high total.
What should I do if I receive an email claiming to be from Osaka City?
Treat unexpected messages cautiously. Do not enter passwords or payment-card details through an email link; visit the city’s official website directly to check account or application information.
Was Osaka City’s own system hacked?
The city says no breach of its own online system has been found, and TKC says its systems were not the source of the intrusion. The confirmed access occurred at Arara Message, the email delivery service TKC used.
Source: ThorstenMeyerAI.com
