TL;DR
Osaka City confirmed on November 13 that 1,078,713 email addresses associated with its administrative online system were exposed after unauthorized access to Arara Message, an email delivery service used by system provider TKC. The city and TKC say the exposed data was limited to email addresses; users should treat unexpected messages claiming to be from the city with caution.
Osaka City confirmed on November 13 that 1,078,713 email addresses connected to its administrative online system were exposed after unauthorized access to Arara Message, an email delivery service used by system provider TKC Corporation. The city and TKC say only email addresses were affected; they report no exposure of message contents, Japan’s My Number identifiers or application data.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The city says the affected addresses belong to people who received messages from info-osaka-online@city.osaka.lg.jp between July 1 and October 31, 2026. Those messages included account registration and changes, login notices, applications, application status updates and announcements. Osaka explained that the count is large in part because the system sent a notice to all registered users on September 16. The total is a count of email addresses, not a verified number of people; the city has not published a count of unique individuals.
According to the city’s November 13 report, TKC matched information received from the email service provider against its customers’ systems to identify the Osaka addresses. TKC said it received the leaked addresses from Arara on November 4 and began sorting them by customer and system. Arara says about 81.3 million email addresses were taken from its service overall, across as many as about 380 client companies. That company-wide figure covers the provider’s broader incident, not just Osaka users.
The city says no unauthorized access to its own online system has been found, and TKC has likewise said it found no break-in to its systems. The reported access occurred at Arara, further down the chain used to deliver the city’s email. Osaka says it is seeking a detailed report from TKC on the cause, scope and prevention measures. The city has not said whether it will notify affected users individually; its report says individual notification is under consideration and that it cannot confirm whether a particular address was affected in response to inquiries.
Why the Leak Raises Phishing Risk
An exposed address can make it easier for someone to send a convincing message that appears connected to a service a user has actually used. In this case, the affected accounts received messages about logins, applications and account changes, details that could be echoed in deceptive emails. The city has warned users to watch for fake messages in its name, but the source material does not establish that every affected person has received a scam message.
The incident also shows how a service can be affected through a supplier’s supplier. Osaka’s system and TKC’s systems were not identified as the point of unauthorized access; the email delivery provider was. For residents, the immediate concern is whether an unexpected message is genuine. For the city and its contractor, the episode raises questions about how third-party services are assessed and monitored when they handle communications tied to public services.
Products Worth Considering
DJI Mic 3 (2 TX + 1 RX + Charging Case) Wireless Microphone
Amazon Kindle Paperwhite (2024, 16 GB) – 7-inch Display, Black
Bose TV Speaker (2nd Gen) – Compact Soundbar with Bluetooth and HDMI‑ARC Connectivity, Clear Dialogue, Dolby Atmos, Deep Bass, Remote Contro
As an affiliate, we earn on qualifying purchases.
How the Vendor Chain Was Exposed
TKC operates Osaka’s administrative online system and used Arara Message to send its emails. The sequence reported by Osaka, TKC and Arara began on October 22, when Arara temporarily stopped service while responding to a PHP vulnerability, according to TKC. Arara confirmed unauthorized access on October 28, and its service began sending fake card-related emails, the source material reports. Arara shut down the service on October 31; from about 17:40 that day, Osaka’s system could not send email.
TKC told Osaka on November 2 that user addresses might have leaked. TKC said the affected data was limited to email addresses on November 4, the same day it received the leaked address data from Arara. Osaka published its final report and apology page on November 13, giving the city’s confirmed total. This timeline is based on the city’s releases, TKC reports and disclosures from Arara and its parent company, PayCloud Holdings.
“Users’ email addresses, 1,078,713 records.”
— Osaka City, November 13 incident report
What the City Has Yet to Confirm
The city has not said whether it will send individual notices, and it says it cannot tell people who ask whether a particular address was included. The published total refers to email addresses, not a confirmed number of people; the number of unique individuals remains unknown. Osaka has asked TKC for more detail on the cause, scope and safeguards, so the investigation and review are not fully described in the material available.
The city and TKC report that message contents, My Number identifiers and application data were not exposed. The source material does not provide independent technical findings that would allow readers to assess those conclusions. It also does not identify the unauthorized party or establish how the stolen addresses have been used beyond the reported fake emails from Arara’s service.
Osaka’s Review and User Guidance
Osaka says it has requested a detailed report from TKC and will review how personal information is handled by external services, the safety measures in place and coordination with vendors. The city has not announced a date for completing that review or for deciding on individual notifications.
For now, users should be cautious with unexpected messages claiming to come from Osaka City. Do not enter passwords or payment card details through a link in an email; instead, go to the city’s website directly to check notices. Treat the sender name and address as insufficient proof that a message is genuine, and follow updates published by Osaka City as it reports further findings.
Key Questions
Whose email addresses were exposed?
The city says the leak covers addresses that received messages from info-osaka-online@city.osaka.lg.jp between July 1 and October 31, 2026. The messages related to Osaka’s administrative online system.
Were passwords or application records leaked?
Osaka and TKC say the exposed information was limited to email addresses. They say message contents, My Number identifiers and application data were not leaked.
Does the total mean 1,078,713 people were affected?
No. The city reported 1,078,713 email addresses. It has not published a count of unique people, and one person could have more than one address.
What should I do if I receive an email claiming to be from Osaka City?
Be cautious with unexpected messages. Do not provide passwords or card details through email links; check information by visiting the city’s website directly.
Will Osaka tell me if my address was included?
The city says individual notification is under consideration and that it cannot answer inquiries about whether a specific address was affected.
Source: Thorsten Meyer AI
