TL;DR
The City of Osaka said on November 13 that 1,078,713 email addresses used by its administrative online system were exposed after unauthorized access to Arara Message, an email service used by system provider TKC. The city and TKC say email contents, My Number data and application information were not leaked; the number of individual people affected is unknown.
The City of Osaka said on November 13 that 1,078,713 email addresses linked to its administrative online system were exposed after unauthorized access to Arara Message, an email delivery service used by system provider TKC Corporation. Osaka and TKC say the leak involved email addresses only, while the number of individual people affected has not been established.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The affected addresses belong to people who received messages from info-osaka-online@city.osaka.lg.jp between July 1 and October 31, 2026. The city says those messages covered registration, account changes, logins, applications, application status updates and announcements. It attributes the large address count partly to a notice sent to every registered user on September 16.
Osaka says it identified its users’ addresses using data passed from Arara to TKC, which sorted the exposed records by customer and system. TKC reportedly received the data on November 4. The city says it has found no evidence of unauthorized access to its own online system; TKC also says no breach of its systems was found. The unauthorized access occurred at Arara, further down the service chain.
According to the city and TKC, the exposed information did not include message contents, Japan’s My Number personal identification numbers, or application data. Arara has reported that approximately 81,329,467 email addresses were taken across as many as 380 client companies. That is Arara’s total address count, not a count of people, and it does not establish how many distinct individuals were affected.
How the Leak Could Affect Osaka Users
Exposed addresses can be used to target recipients with convincing messages that imitate a government service. Because the affected system sent account and application notices, a fraudulent email could appear relevant to someone who used Osaka’s online services. The city has warned users to be alert to messages falsely claiming to come from Osaka.
For readers, the practical risk is deception through email, not a confirmed exposure of passwords or application records. An address in the affected set may make a person easier to target, but the available notices do not say that attackers gained access to accounts or can log in using the leaked addresses alone. The incident also highlights how a breach at an outsourced supplier can affect users of a public service even when the city’s own system has not shown signs of intrusion.
Products Worth Considering
Logitech MX Vertical Wireless Ergonomic Mouse
Apple MacBook Pro 2026 14.2 Laptop with M5 Pro chip, 15‑core CPU, 16‑core GPU, 24 GB Unified Memory, 1 TB SSD, Wi‑Fi 7 – Silver
Ledger Stax Crypto Wallet with Touchscreen
As an affiliate, we earn on qualifying purchases.
The Vendor Chain Behind the Exposure
Osaka’s administrative online system is run by TKC Corporation, which used Arara Message to deliver system emails. The city’s notices describe the exposed data as addresses tied to messages sent through that arrangement. The breach therefore occurred at an email service used by the city’s provider, rather than at the city’s online system, according to the accounts published so far.
The disclosed sequence began on October 22, when Arara Message briefly suspended service while responding to a PHP vulnerability, according to TKC’s account. Arara confirmed unauthorized access on October 28; its service also began sending fraudulent card-related emails, the source material reports. Arara shut down the service on October 31, and Osaka’s system could no longer send email from about 17:40 that day. TKC informed Osaka on November 2 that user addresses might have been exposed. The city published its confirmed count on November 13.
“Users’ email addresses, 1,078,713 records.”
— City of Osaka, translated from its November 13 notice
What Osaka Has Yet to Confirm
The city has not published a count of distinct people affected. The 1,078,713 figure refers to email addresses or records, and a person may have more than one address or appear in records in ways the disclosures do not explain. Arara’s much larger total likewise counts addresses, not people.
Osaka says individual notifications are under consideration and that it has requested a detailed report from TKC on the cause, scope and prevention measures. The notices do not establish how the unauthorized party accessed Arara’s service, whether the stolen addresses have been misused, or whether every potentially affected user will receive direct notice. Osaka and TKC say they have found no intrusion into their own systems, but the city’s review of the incident and vendor safeguards is ongoing.
Osaka Reviews Vendor Safeguards
The city says it will seek further details from TKC and review its handling of personal information by external services, safety management measures and cooperation with vendors. It has not stated when that review will be completed or whether it will notify users individually. Users should check the city’s official website for new notices, since Osaka says it cannot confirm exposure for a specific address through individual inquiries.
For now, treat unexpected messages claiming to come from Osaka as unverified. Do not follow a link to provide a password, payment card details or other sensitive information; instead, open the city’s official site directly to check a claim. The available disclosures identify exposed addresses but do not confirm that passwords, accounts or application data were compromised.
Key Questions
Was my Osaka City email address exposed?
If you received a message from info-osaka-online@city.osaka.lg.jp between July 1 and October 31, 2026, your address may be in the affected set. Osaka says it cannot answer whether a particular address was exposed.
What information was leaked?
The city and TKC say the exposed information was email addresses only. They say email contents, My Number data and application information were not leaked.
How many people were affected?
The city reported 1,078,713 email addresses, not a verified count of people. No distinct-person total has been published.
Should I change my password?
The disclosures do not say that passwords were exposed. Be cautious with unexpected messages, and do not enter credentials or payment details through an email link. Check service information through Osaka’s official website.
Where did the breach happen?
Osaka says the unauthorized access occurred at Arara Message, an email delivery service used by TKC, the provider of the city’s online system. The city and TKC say they found no breach of their own systems.
Source: Thorsten Meyer AI
