TL;DR
Osaka confirmed on November 13 that 1,078,713 email addresses linked to users of its administrative online system were exposed in a breach at Arara Message, an email delivery service used by system provider TKC. The city and TKC say email contents, My Number data and application information were not leaked; the number of individual people affected is unknown.
The city says the affected addresses belong to people who received messages from info-osaka-online@city.osaka.lg.jp between July 1 and October 31, 2026. Those messages covered account registration and changes, logins, applications, application status updates and city announcements. Osaka said a notice sent to all registered users on September 16 accounts for the large number of addresses in the affected set. The figure counts email addresses, not confirmed individuals; the city has not published a count of people affected.
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Osaka said the count was identified using data that Arara provided to TKC, which matched the exposed addresses to the city’s system. TKC said it received the data on November 4 and began sorting it by customer and system. The city’s November 13 release gave the final count and warned people to be cautious about messages claiming to be from Osaka.
According to the city and TKC, the exposed information was limited to email addresses. They say the messages themselves, Japan’s My Number personal identification numbers and application data were not leaked. The city says it has asked TKC for a detailed report on the cause, scope and steps to prevent a recurrence. Individual notifications to affected users are still under consideration, and the city says it cannot confirm whether a particular address was involved.
A Breach Across the Vendor Chain
The incident shows how personal information used by a public service can be exposed through an outside provider several steps removed from the agency. Osaka says its own online system showed no signs of a break-in, and TKC likewise says no intrusion into its systems was found. The unauthorized access occurred at Arara Message, TKC’s email delivery provider, which handled messages sent by the city’s system.
People whose addresses were exposed may receive convincing unsolicited messages that imitate city notices. An email address alone does not establish that passwords or government records were accessed, according to the city and TKC. Still, the exposure can give scammers a way to target people who used Osaka’s services. The city’s advice is to treat unexpected messages claiming to be from it with care and verify information through the city’s website.
The wider scale reported by Arara adds to the potential reach. The company says 81,329,467 email addresses were taken from its service across up to about 380 client companies. That is a count of addresses, not people, and the source material does not establish how many belong to unique individuals or how many were used for active accounts.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Samsung 27-inch Odyssey OLED G6 QHD Gaming Monitor
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
As an affiliate, we earn on qualifying purchases.
How the Exposure Was Traced
The system chain described by Osaka and TKC runs from residents using the city’s administrative online service to TKC, which operates that system, and then to Arara, which delivered its emails. The city says unauthorized access happened at Arara, rather than at the city system or TKC. The attacker has not been named in the notices described in the source material.
TKC’s account of the sequence says Arara briefly stopped its service on October 22 while responding to a PHP vulnerability. Arara confirmed unauthorized access on October 28; its service then began sending fraudulent card-related emails, according to the timeline provided by TKC. Arara shut down the service on October 31, after which Osaka’s system could not send emails from about 17:40 Japan time. TKC told the city on November 2 that addresses might have leaked. TKC said on November 4 that only email addresses were affected and that Arara had provided it with the exposed address data.
Osaka issued statements on November 3, 4 and 13, with the last release confirming the total. The timing of the service interruption and the later review helps explain why the city’s final count came after TKC received and sorted the data.
““The email addresses of users of the system leaked to outside parties.””
— City of Osaka, November 13 notice
What the Investigation Has Not Settled
The published account does not identify who accessed Arara’s service or explain the full method of access. Osaka says it has requested a detailed report from TKC on the cause, scope and prevention measures, so the investigation and vendor review are still developing.
The number of affected people is also unknown. Osaka’s figure is a count of email addresses, and neither the city nor the source material provides a count of unique individuals. The city has not said whether it will send direct notices, and it says it cannot determine exposure for an individual address in response to inquiries. The city and TKC say no email contents, My Number data or application records were leaked; the available information does not provide an independent technical assessment of those findings.
City and Vendors Review Safeguards
Osaka says it has asked TKC to provide a detailed report on the incident and will review how personal information is handled by external services, the safety measures applied to them and coordination with vendors. The city says individual notifications are under consideration, but it has not announced a schedule or a decision.
Until further information is published, people who received messages from the Osaka system during the July 1–October 31 period can avoid acting on unexpected links or requests for passwords or payment details. The city advises users to check information through its official website. Further updates are expected as Osaka receives TKC’s report and decides whether to contact users directly.
Key Questions
How many Osaka user email addresses were exposed?
Osaka confirmed 1,078,713 email addresses. That is a count of addresses, not a confirmed count of individual people.
Who may be affected?
The city says the affected addresses are those that received an email from info-osaka-online@city.osaka.lg.jp between July 1 and October 31, 2026. It says it cannot confirm exposure for an individual address through inquiries.
What information does Osaka say was leaked?
The city and TKC say only email addresses were exposed. They say email contents, My Number data and application information were not leaked.
Where did the breach occur?
Osaka and TKC say unauthorized access occurred at Arara Message, the email delivery service TKC used for messages from the city’s online system. They say no break-in at Osaka’s system or TKC’s systems was found.
What should users do about suspicious messages?
Osaka advises users to be cautious with unexpected messages claiming to come from the city. Do not provide passwords or payment details through a link in an unsolicited email; check information on the city’s official website.
Source: Thorsten Meyer AI
