🔍 Read the full analysis: Osaka Data Breach Explained: The Vendor’s Vendor And The Email Leak on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Osaka City confirmed on November 13 that 1,078,713 email addresses linked to its online administrative system were exposed in a breach at Arara Message, an email service used by provider TKC. The city and TKC say the exposed data was limited to email addresses, not message contents, My Number data or application records. The number counts addresses, not confirmed individual people.
Osaka City said November 13 that 1,078,713 email addresses linked to its administrative online system were exposed after attackers accessed Arara Message, an email delivery service used by system provider TKC Corporation. The city says it has found no intrusion into its own online system, and TKC says its systems were not the point of entry; the incident occurred further down the vendor chain.
The city’s final report counts addresses that received messages from the system between July 1 and October 31, 2026. These included account registration and password-change messages, login notices, application communications, status updates and announcements. The city says the total is high in part because it sent an email to all registered users on September 16. People with an account on that date should treat their address as potentially included, although the city says it cannot check or confirm whether a particular address was affected.
According to Osaka and TKC, the exposed information was email addresses only. They say email contents, Japan’s My Number personal identification data and application information were not leaked. The city says it identified its users’ addresses using information supplied by Arara to TKC, which sorted and matched the data. TKC says it received the leaked addresses from Arara on November 4 and began organizing them by client and system that day.
Arara reported a much wider incident: 81,329,467 email addresses were taken from its service, after duplicate records were removed, across as many as about 380 client companies. That figure refers to addresses, not a verified count of people. Osaka has asked TKC for a detailed account of the cause, scope and steps to prevent a repeat, and says it will review how personal information is handled by external services and how it coordinates with vendors.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
The Risk Beyond Osaka’s Systems
The incident shows how a breach at a subcontracted service can expose contact information used by a public service even when the city’s own system has not been found to be compromised. TKC supplied Osaka’s online system, while Arara handled email delivery. For users, that distinction does not remove the practical risk: their addresses may be used to target them with messages that appear to come from the city or other organizations affected by Arara’s breach.
Osaka advises users to be cautious with unexpected messages claiming to be from the city. Readers should avoid entering passwords or payment-card details after following links in unsolicited emails and should check notices through the city’s website instead. The city’s confirmation also matters because email addresses are not the same as people: one person may have more than one address, and the published total does not establish how many individuals were affected.
Popular right now
Ninja CREAMi 7-in-1 Ice Cream Maker, NC301
TCL 55-Inch T7 Series 4K QLED Smart Google TV (55T7)
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose
As an affiliate, we earn on qualifying purchases.
How the Vendor Chain Was Breached
The reported activity took place in late October. TKC’s account says Arara temporarily took its service offline on October 22 in response to a PHP vulnerability. Arara later recorded what it described as apparent reconnaissance on October 27. On October 28, an attacker accessed an administrator screen in a shared environment and copied data, while the service also began sending fraudulent credit-card emails. Arara confirmed unauthorized access that day.
Arara’s response and estimates changed as the investigation developed. On October 29, its parent company, PayCloud Holdings, disclosed an initial estimate of about 3.01 million addresses from one shared system. Arara later found that data had also been taken through its service as the attacker accessed additional servers. It shut down the environment used by TKC for local-government systems on October 31, after which Osaka’s system could no longer send email. Arara completed the shutdown of its service that evening.
On November 2, Arara reported an estimate of about 77 million addresses. TKC then told Osaka that personal details including names might be involved and that up to 2,230,812 addresses associated with its customers could be affected. On November 4, TKC told the city that only email addresses were involved. Arara’s November 6 report raised its total to 81,329,467 after removing duplicates. Osaka published its final count on November 13.
“The number is very large because a notice email was sent from the system to everyone registered as a user on Wednesday, September 16, 2026.”
— Osaka City, in its November 13 report
What the Published Counts Cannot Show
The confirmed Osaka figure is a count of email addresses, not people. The city has not published a number of distinct individuals affected and says it cannot answer address-by-address inquiries. Although the city and TKC say other categories of data were not exposed, their statements do not provide a public, independently verified account of every record accessed across Arara’s wider customer base.
The precise route by which the attacker moved through Arara’s systems, the full technical cause and the complete customer-by-customer impact remain matters for investigation. Osaka says it has requested a detailed report from TKC. The city’s confirmation that its own online system was not breached should not be read as a finding that every system in the vendor chain was unaffected; Arara has acknowledged unauthorized access to its service.
City and Vendors Face Follow-Up
Osaka says it is considering whether to notify affected users individually and will seek a detailed report from TKC covering the cause, scope and prevention measures. It has not announced a date for those steps or said whether individual notices will be sent. Users who want to verify city information should consult Osaka’s official website rather than relying on links in unexpected messages.
TKC and Arara’s further findings may clarify how the data was accessed and which other clients were affected. Until those details are published, people who received Osaka system emails during the stated period should treat suspicious messages cautiously. The city’s next public update, if issued, is expected to address the vendor review and any additional findings; no specific timing has been announced.
Key Questions
What information about Osaka users was exposed?
Email addresses, according to Osaka City and TKC. They say email contents, My Number information and application data were not leaked.
Who may be affected?
Addresses that received messages from Osaka’s administrative online system between July 1 and October 31, 2026. The city says a September 16 notice to all registered users contributed to the large count.
Does the figure mean more than one million people were affected?
No. Osaka reported 1,078,713 email addresses, not a confirmed number of people. The city has not published a count of distinct individuals.
Was Osaka City’s own online system hacked?
The city says it has found no intrusion into its online system. The breach was at Arara Message, an email delivery service used by TKC, the system provider.
What should users do about suspicious emails?
Be cautious with unexpected messages claiming to come from Osaka City. Do not enter passwords or card details through email links; check information through the city’s official website.
Source: ThorstenMeyerAI.com
