🔍 Read the full analysis: Osaka Data Breach FAQ: What To Know About The 1.08 Million Emails on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Osaka City confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed in a breach at Arara Message, an email service used by system provider TKC. The city and TKC say the exposed information was limited to email addresses; they say message contents, My Number details and application data were not leaked. The number refers to addresses, not a confirmed count of individuals.
Osaka City confirmed November 13 that 1,078,713 email addresses associated with its administrative online system were exposed in a breach at Arara Message, an email delivery service used by system provider TKC Corporation. The city and TKC say the leaked information was limited to email addresses, not message contents, My Number details or application data; the total is a count of addresses, not a confirmed number of people.
The city’s final report identifies the affected addresses as recipients of emails sent through the system between July 1 and October 31, 2026. Messages covered account registration, email or password changes, logins, applications, application-status updates and announcements. Osaka said a notice sent to all registered users on September 16 accounts for the high total. People who held an account on that date should treat their address as likely included, although the city says it cannot confirm exposure for individual addresses.
The incident occurred at Arara Message, which TKC used to deliver the city system’s emails. Arara reported that 81,329,467 email addresses were taken across its service after duplicate entries were removed. It said the data came from as many as about 380 client companies and stressed that the number represents addresses, not people. Osaka’s figure is the subset identified as belonging to users of its system.
According to the city, the affected addresses were identified using information Arara gave TKC, which sorted and matched the data to customer systems. TKC said it received the exposed addresses from Arara on November 4 and began sorting them by customer and system that day. Osaka says it has asked TKC for a detailed account of the cause, scope and measures to prevent a recurrence.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Risks for Osaka Service Users
Email addresses are limited personal information compared with passwords or identity numbers, but their exposure can still make users more vulnerable to phishing and impersonation. A message that refers to a city service, application or account could appear credible, particularly if it reaches someone who has used the system. The breach does not establish that any particular user has received a fraudulent message or suffered financial loss.
Users should be cautious with unexpected messages claiming to come from Osaka City. Avoid entering passwords or payment-card details after following a link in an email, and check announcements by going directly to the city’s website. The incident also shows how a public service can face data risk through an outside vendor used by its system provider, even when the city’s own online service has not been found to have been breached.
Products Worth Considering
Levoit Core 600S-P Smart Air Purifier for Large Rooms
Blueair Signature SP1i Smart Air Purifier
Withings BPM Vision Blood Pressure Monitor
As an affiliate, we earn on qualifying purchases.
Breach Spread Through Email Vendor
Osaka said it found no unauthorized access to its own online system, and TKC likewise said it found no breach in its own system environment. The exposure instead involved the email-delivery service in the vendors’ chain. These findings describe what the city and TKC reported; they do not mean no systems elsewhere in the chain were affected.
Arara’s account, as described in company and parent-company disclosures, places the activity between October 27 and October 31. Arara observed what appeared to be reconnaissance on October 27 and reported unauthorized access to an administrator screen in a shared environment on October 28. It later found that data had also been taken through its service. On October 31 it shut down the environment used for TKC’s local-government systems; Osaka’s system then could not send email. Arara completed a shutdown of its service that evening.
Arara’s reported total grew as its investigation progressed: it first disclosed a smaller count, then about 77 million addresses, and on November 6 reported 81,329,467 after removing duplicates. Osaka released earlier notices on November 3 and 4 before issuing its final count on November 13. November 2 was the date of an Arara report, not the start date of the activity described in the company’s timeline.
“It has been confirmed that the email addresses of users of the system leaked to outside parties.”
— Osaka City, in its November 13 notice
Individual Exposure Still Unconfirmed
The city has not published a count of unique people affected, and its address total cannot be converted into one: a person may have more than one address, and the available information does not establish how many addresses belong to the same person. Osaka also says it cannot tell an individual whether a specific address was included.
Osaka says the city system’s email contents and application data, along with My Number information, were not leaked. The city and TKC also report no breach of their own systems. The breach was attributed to Arara’s service, but the city says it is seeking a detailed report on the cause, full scope and steps to prevent a repeat. The source material does not establish whether exposed addresses have been used for fraud or whether other information was accessed beyond what the companies have reported.
City Reviews Vendor Safeguards
Osaka says it will review how personal information is handled by external services, examine safety-management measures and reassess coordination with vendors. It has asked TKC to provide a detailed report covering the cause, scope and prevention steps. The city says individual notices to affected users are under consideration; it has not confirmed that they will be sent.
For users, the immediate advice is to treat unexpected messages claiming to be from the city with caution, avoid entering credentials or card details through email links, and check information through Osaka’s official website. Further updates may clarify vendor findings and the city’s notification plans, but no individual-address lookup has been announced.
Key Questions
What information did Osaka confirm was exposed?
Osaka confirmed that 1,078,713 email addresses associated with its administrative online system were included in data exposed through Arara Message. The city and TKC say email contents, My Number details and application data were not leaked.
Who may be affected?
The addresses were recipients of system emails sent between July 1 and October 31, 2026. Osaka said a message to all registered users on September 16 contributed to the total. The city cannot confirm whether a particular address was exposed.
Does the figure mean more than one million people were affected?
No. It is a count of email addresses, not people. Osaka has not released a count of unique individuals, and the number of people cannot be determined from the published total.
What should users do about emails claiming to be from Osaka City?
Be cautious with unexpected messages, do not enter passwords or payment-card information after clicking an email link, and check information by visiting the city’s website directly. The report does not establish that exposed addresses have been used in a scam.
Will Osaka notify each affected user?
The city says individual notices are under consideration. It has not confirmed a notification plan and says it cannot answer inquiries about whether a specific address is affected.
Source: ThorstenMeyerAI.com
