🔍 Read the full analysis: After The Osaka Email Leak: Practical Steps For Affected Users on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Osaka confirmed on November 13 that 1,078,713 email addresses linked to its administrative online system were exposed after a breach at Arara Message, an email service used by system provider TKC. The city and TKC say the exposed data was limited to email addresses; users should treat unexpected messages claiming to be from Osaka as suspicious and verify information through the city’s website.
Osaka confirmed on November 13 that 1,078,713 email addresses associated with users of its administrative online system were exposed after unauthorized access at Arara Message, an email delivery service used by system provider TKC Corporation. The city and TKC say the leak involved email addresses only, not message contents, Japan’s My Number identification data or application records.
The city says the affected addresses are those that received messages from its online system between July 1 and October 31, 2026. Messages covered account registration, email or password changes, logins, applications, application-status updates and announcements. Osaka said a notice sent to all registered users on September 16 contributed to the high total. The figure counts email address records, not necessarily individual people; no count of affected people has been published.
Osaka identified the addresses using information supplied by TKC, which sorted and matched data provided by Arara. TKC said it received the exposed addresses from Arara on November 4 and began determining which customer systems they related to. The city says it has asked TKC for a detailed report on the cause, scope and steps to prevent a repeat.
Arara’s November 6 report put the total taken from its service at 81,329,467 email addresses, after removing duplicates. The company said the data came from as many as about 380 client companies. That broader total is not a count of people, and it does not mean every address belonged to an Osaka user.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
How the Vendor Breach Reached Osaka Users
The incident shows how a breach at a third-party email provider can affect users of a public service even when the city’s own system is not found to have been breached. Osaka says it found no intrusion into its online system, and TKC likewise says no break-in to its own systems was found. The exposed addresses could still make affected users easier to target with messages that imitate city notices or refer to online-service activity.
For users, the practical risk is not that the reported leak contained passwords or application details—it did not, according to the city and TKC—but that a known email address can be used to send plausible-looking messages. A message that appears to come from Osaka should not be trusted solely because it mentions an account, application or city service. Users can reduce risk by avoiding links in unexpected messages and checking notices through the city’s official website.
Products Worth Considering
Amazon Kindle Scribe (32GB) with Premium Pen, Tungsten (Like-New)
Bose TV Speaker (2nd Gen) Compact Soundbar with Bluetooth and HDMI-ARC, Black
Samsung 57 Odyssey Neo G9 (G95NC) Dual 4K UHD 1000R Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Arara Access to Osaka’s Report
Arara said it detected unauthorized access on October 28, after activity it described as apparent reconnaissance the previous day. The company reported that an attacker accessed an administrator screen in a shared environment and copied data. Arara later found that the attacker had used its service to reach additional servers. On October 31, Arara shut down the environment used for local-government systems; Osaka said its system could no longer send email from about 17:40 Japan time.
Arara’s public estimates rose as its investigation progressed: an initial report on October 29 referred to about 3.01 million addresses from one shared system; its November 2 report put the total at about 77 million; and its November 6 report gave the final figure of 81,329,467 after deduplication. Osaka issued its own initial notices on November 3 and 4 before publishing the confirmed count on November 13. November 2 was a date of an Arara report, not the start date of the incident.
“Users’ email addresses, 1,078,713 records.”
— City of Osaka, November 13 report
Individual Exposure and Follow-Up Reports
Osaka has not said whether it will send individual notifications; it described those notices as under consideration. The city also says it cannot answer inquiries about whether a particular address is included. Although the city and TKC say only email addresses were affected, Osaka has requested a fuller account of the cause, scope and preventive measures, so its review of the vendor incident remains relevant.
The total of 1,078,713 refers to addresses, not verified individuals. The source material does not establish how many people used more than one address, whether any exposed address has since been used in a scam, or whether all affected users have been reached. There is also no published count of Osaka users who received suspicious follow-up messages.
Osaka’s Vendor Review and User Notices
The city says it will examine how personal information is handled by external services, the safety measures in place and coordination with vendors. It has asked TKC to provide a detailed report on the incident and measures against recurrence. Osaka has not announced a deadline for that report or a final decision on individual notices.
Until the city provides further updates, users who received messages from info-osaka-online@city.osaka.lg.jp during the affected period should be alert to unexpected emails claiming to be from Osaka. Do not enter passwords or payment-card details after following a message link. Instead, open the city’s official website independently and check there for service information or account actions.
Key Questions
What information does Osaka say was exposed?
The city and TKC say the leak was limited to email addresses. They say email contents, My Number data and application records were not exposed.
Who may be affected?
The city says the affected addresses received messages from its administrative online system between July 1 and October 31, 2026. It says an email sent to all registered users on September 16 contributed to the total.
Does the figure mean more than one million people were affected?
No. Osaka confirmed 1,078,713 email address records, not a count of distinct people. The number of individuals affected has not been published.
Can Osaka confirm whether my address was leaked?
The city says it cannot answer inquiries about individual addresses. It has not announced whether it will send individual notifications; those are still under consideration.
What should users do about emails claiming to be from Osaka?
Treat unexpected messages cautiously. Avoid clicking links or entering passwords or card details from an email; check information by going directly to the city’s official website.
Source: ThorstenMeyerAI.com
