Read the full analysis: How The Osaka Vendor’s Vendor Breach Exposed 1.08 Million Email Addresses on ThorstenMeyerAI.com
TL;DR
Osaka confirmed on Nov. 13 that 1,078,713 email addresses linked to its online administrative system were exposed after an attacker accessed Arara Message, an email service used by provider TKC. The city and TKC say the exposed information was limited to addresses, not message contents, My Number data or application records; the number of affected people is unknown.
Osaka City confirmed on Nov. 13 that 1,078,713 email addresses associated with its online administrative system were exposed in a breach at Arara Message, an email delivery service used by system provider TKC Corporation. The city says investigators found no intrusion into Osaka’s own system, and the exposed data was limited to email addresses.
The addresses belonged to recipients of messages sent through the system from July 1 through Oct. 31, 2026. Those messages included account registration and login notices, password or email changes, application updates and city announcements. Osaka said a notice sent to all registered users on Sept. 16 accounts for the high total. The count refers to email-address records, not a confirmed number of people.
Osaka said the city’s system provider, TKC, matched information supplied by Arara against its customer systems to identify the city addresses. TKC said it received the exposed address data from Arara on Nov. 4 and began sorting it by customer and system that day. The city’s final report was published at 1 p.m. Japan time on Nov. 13.
Osaka and TKC say no other data was exposed in the city’s system. They reported no leakage of message contents, Japan’s My Number personal identification numbers or application data. The city has asked TKC for a detailed report on the cause, scope and steps to prevent a recurrence. Whether Osaka will send individual notices to affected users remains under consideration.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
Nov 2TKC tells the city that user addresses may have leaked
Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
Nov 13The city confirms the count and warns of fake emails in its name
Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Why the Address Exposure Matters
Email addresses can be used to send convincing messages that imitate a city service, particularly when recipients have recently used that service or expect updates about applications. Osaka’s warning is therefore relevant even though the city and TKC say message contents and application records were not leaked. A person who receives an unexpected message claiming to be from Osaka should avoid following its links or providing passwords or payment-card details.
The incident also illustrates how a breach at a service provider can affect people who use a public system that the provider supports. Osaka says its own system was not breached, but addresses linked to its users were present in data taken from a separate email service in the supply chain. The city says it will review personal-information handling at external services, safety measures and coordination with vendors.
The published total is large, but it should not be treated as a count of unique residents. Osaka reported 1,078,713 address records; neither the city’s notice nor the supplied reporting establishes how many distinct people those records represent. The available information also does not establish that every recipient will receive a fraudulent message.
How the Vendor Breach Reached Osaka
Arara’s disclosures describe unauthorized activity beginning with apparent reconnaissance on Oct. 27. On Oct. 28, an attacker accessed an administration screen in a shared environment and copied data. Arara also said its service began sending fraudulent credit-card emails that day. The company confirmed unauthorized access and later reported that data had been taken through its service.
Arara’s environment used by TKC for local-government systems was shut down on Oct. 31 at 5:37 p.m. Japan time, according to the supplied chronology. Osaka’s system could no longer send email from about 5:40 p.m.; Arara completed shutting down its service at 7:53 p.m. TKC had received an earlier report from Arara on Oct. 30 saying there was no leak from TKC’s usage environment. Arara subsequently found that data had also been carried out through its service.
Arara’s Nov. 6 report put the total taken from its service at 81,329,467 email addresses after deduplication, across as many as about 380 client companies, according to the source material. That company-wide figure is not the number of Osaka users. Osaka’s Nov. 13 report identified 1,078,713 address records associated with its system.
““The email addresses of users of the system leaked to outside parties.””
— Osaka City, in its Nov. 13 report
What the Published Count Cannot Show
The number of affected people is not known. Osaka’s figure counts email addresses, and the city has not published a unique-person total or a method for residents to check whether a particular address was included. The city says individual inquiries cannot be answered, while individual notifications are still being considered.
The available reports do not establish whether anyone has used the Osaka-linked addresses for targeted fraud, how many people received suspicious messages, or whether further findings could change the stated scope. Osaka and TKC say only addresses were affected in relation to the city system; that finding should not be expanded into a claim about every client or all data held across Arara’s service.
City Review and User Guidance
Osaka says it has requested a detailed account from TKC covering the breach’s cause, scope and measures against a repeat. It also plans to review how external services handle personal information, their safety controls and coordination among vendors. No timetable for those reviews or individual user notices is provided in the source material.
For now, the city advises users to treat unexpected messages claiming to come from Osaka with caution, avoid entering passwords or card details through links in such emails, and check information through the city’s website. The confirmed exposure concerns addresses connected with messages sent from July 1 to Oct. 31; the city has not said that every address can be individually verified.
Key Questions
How many Osaka-related email addresses were exposed?
Osaka reported 1,078,713 email addresses linked to its online administrative system. The figure is a count of addresses, not a confirmed count of people.
What information does Osaka say was exposed?
The city and TKC say the exposed information was limited to email addresses. They say message contents, My Number data and application records were not leaked from Osaka’s system.
Who may be affected?
The addresses were recipients of system emails sent between July 1 and Oct. 31, 2026. Osaka says a notice to all registered users on Sept. 16 contributed to the total. The city has not published a way to check an individual address.
Was Osaka City’s own system hacked?
Osaka says it found no intrusion into its own online system. The breach occurred at Arara Message, an email service used by TKC, the city system’s provider.
What should users do about emails claiming to be from Osaka?
Osaka advises users to be cautious with unexpected messages, avoid entering passwords or card details after clicking a link, and check information through the city’s website.
Source: ThorstenMeyerAI.com