🔍 Read the full analysis: Osaka’s 1.08 Million Email Address Leak: Key Facts And Next Steps on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Osaka confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed in a breach at Arara Message, an email delivery service used by system provider TKC. The city and TKC say the leak involved email addresses only, not message contents, My Number data or application records. People who received system emails from July through October should treat unexpected messages claiming to be from the city with caution.
Osaka confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed in a breach at Arara Message, an email delivery service used by system provider TKC Corporation. The city and TKC say email addresses were the only affected information; they report no leak of message contents, My Number data or application records.
The city’s final report identifies the addresses as recipients of emails sent by the system between July 1 and October 31, 2026. Those messages included registration and account-change notices, login notifications, application updates and city announcements. Osaka said the count was high because the system sent a notice to every registered user on September 16. People who had an account then should assume their address may be included, although the city says it cannot confirm whether any individual address was affected.
The breach occurred at Arara Message, not, according to the city and TKC, through a break-in to Osaka’s own online system or TKC’s system. Arara reported that 81,329,467 email addresses were taken across its service after removing duplicates. It said the data related to up to about 380 client companies; that figure describes email addresses, not a known count of people. Osaka’s 1,078,713 figure is the number of address records it matched to its system.
TKC told Osaka it received leaked address data from Arara on November 4 and began sorting it by customer and system. The city says it identified its affected records using information supplied by TKC. Osaka has requested a detailed report from the provider on the cause, scope and measures to prevent recurrence, and says it is reviewing how external services and vendor coordination are handled.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Risks for Osaka Service Users
The exposed addresses can make it easier for criminals to send convincing messages that appear connected to Osaka’s online services. Because the affected system sent account, application and status notifications, recipients may be accustomed to receiving legitimate messages about those activities. That does not establish that any particular follow-up email is fraudulent, but unexpected links or requests for sensitive information deserve scrutiny.
The city and TKC say the leak did not include passwords, message bodies, My Number information or application data. That narrows what the reported incident exposed, but it does not remove the risk of phishing using a real address or knowledge that someone interacts with a municipal service. The scale also highlights how a vendor’s subcontracted or external delivery service can create exposure beyond the government system itself.
Arara’s total and Osaka’s count are not counts of unique people. One person may use more than one address, and the figures do not establish how many individuals are affected. The available figures should be described as email-address records, not as a confirmed number of residents.
Popular right now
Vitamix Touch & Go Advance 32-Ounce Bar Blender, White
Bose QuietComfort Headphones – Wireless Bluetooth Over-Ear Noise Cancelling Headphones, Petal Pink Limited Edition
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Juniper (KSM150PS)
As an affiliate, we earn on qualifying purchases.
How the Vendor Breach Unfolded
Arara’s reported timeline places the incident in late October. It said it detected apparent reconnaissance on October 27. On October 28, an attacker accessed an administrator screen in a shared environment and copied data, while Arara’s service began sending fake credit-card emails. Arara confirmed unauthorized access that day. On October 31, it shut down the environment used by TKC for local-government systems; Osaka’s system then could not send email. Arara completed the shutdown of its service later that evening.
Arara’s figures changed as its investigation progressed: an initial disclosure cited about 3.01 million addresses from one shared system, a later report put the total at about 77 million, and its November 6 report gave 81,329,467 after deduplication. TKC initially told Osaka that names and other information might be involved, then reported on November 4 that only email addresses were affected. Osaka published its final count on November 13. The incident’s dates should not be confused with November 2, which was the date of an Arara report, not the start date given in the company’s account.
““We cannot answer inquiries about whether an individual email address is affected by this leak.””
— City of Osaka, on individual checks
What Users Still Cannot Verify
Osaka has not published a way for users to check whether a particular address appears in the affected records. The city says individual notifications are under consideration, but it has not confirmed whether or when they will be sent. The total number of people affected also remains unknown because the published counts refer to email addresses, not verified individuals.
The city and TKC say only addresses were exposed, while the broader investigation into Arara’s breach and its client systems is the basis for the reported totals. Further details about the attack’s cause, the full handling of the stolen data and what safeguards will change have not been supplied in the material available here. The city has requested a detailed report, so its review may add information.
City Review and User Precautions
Osaka says it has asked TKC for a fuller account of the incident, including its cause, scope and prevention measures. The city also plans to review personal-information handling by external services, safety controls and coordination with vendors. It has not announced a deadline for that review or a confirmed date for any direct notice to affected users.
For now, the city advises users to treat unexpected messages claiming to come from Osaka with caution. Do not use links in a suspicious email to enter passwords or payment-card details; instead, check information through the city’s official website or contact channels reached independently. The confirmed leak concerns addresses, but users should remain alert to messages that exploit that connection without assuming every email mentioning the city is fraudulent.
Key Questions
How many Osaka email addresses were exposed?
The city confirmed 1,078,713 email address records associated with its online administrative system. This is a count of addresses, not a confirmed count of people.
What information does Osaka say was leaked?
Osaka and TKC say the exposed information was email addresses only. They say message contents, My Number data and application records were not leaked.
Which users may be affected?
The city identified recipients of system emails sent from July 1 through October 31, 2026. It said a notice went to all registered users on September 16, so people with an account then should assume their address may be included.
Can I ask Osaka whether my address was included?
The city says it cannot confirm individual addresses. It has said individual notifications are under consideration, but has not confirmed whether they will be sent.
What should users do about emails claiming to be from Osaka?
Treat unexpected messages cautiously. Do not enter passwords or card details through an email link; check notices through the city’s official website or independently reached contact channels.
Source: ThorstenMeyerAI.com
