By Thorsten Meyer | November 14, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
If you used the City of Osaka’s online services this year, take a careful look at the next email that claims to come from the city. On November 13, Osaka confirmed that 1,078,713 user email addresses from its administrative online system had leaked. The city says no break-in at its own online system has been found, and its software provider says the same about its systems. The break-in happened one step further down the chain, at the email delivery service the provider used to send the city’s messages. That service, Arara Message, says about 81 million email addresses were taken from it in total.
Key takeaways
- What Osaka confirms: in a notice dated November 13, 2026, the city says that after unauthorized access to an email distribution service used by TKC Corporation, the provider of its online system, “it has been confirmed that the email addresses of users of the system leaked to outside parties.” The count: 1,078,713 email addresses.
- Who is affected: anyone who received an email from the system, sender info-osaka-online@city.osaka.lg.jp, between July 1 and October 31, 2026. The number is high because the city sent a notice to every registered user on September 16.
- What leaked, and what did not: only email addresses, according to TKC and the city. Email bodies, My Number (Japan’s personal ID number) and application data were not leaked, they say.
- Where it happened: at Arara, the email service TKC used. Arara says 81,329,467 email addresses were taken in total, from up to about 380 client companies, and stresses that these are addresses, not people.
- Is “1 million” right? As a count of email addresses, yes. As a count of people, nobody has published one.
- What to do: treat any unexpected email that claims to be from Osaka City as suspect, never enter passwords or card data after clicking a link, and check information on the city’s website instead. The city will not confirm whether an individual address is affected.
Osaka email leak · Oct 22 – Nov 13, 2026
How Osaka’s user emails leaked through a vendor’s vendor
No break-in at the city’s system or at its provider has been found, they say. The attack hit the email service one step further down.
Where the addresses were (schematic)
What happened
- Oct 22Arara Message briefly stopped for a PHP vulnerability responseper TKC
- Oct 28Arara confirms unauthorized access; its service starts sending fake card emails
- Oct 31Arara shuts its whole service down; from about 17:40 Osaka’s system cannot send email
- Nov 2TKC tells the city that user addresses may have leaked
- Nov 4Only email addresses affected, says TKC; Arara hands it the leaked addresses
- Nov 13The city confirms the count and warns of fake emails in its name
info-osaka-online@city.osaka.lg.jp between July 1 and Oct 31, 2026. Addresses, not people.Sources: City of Osaka, notice and press releases of Nov 3, 4 and 13, 2026; TKC Corporation, reports one to six; Arara and PayCloud Holdings disclosures. The chain is a schematic.
Graphic: Powered by Thorsten Meyer AI
Products Worth Considering
Bose TV Speaker (2nd Gen) – Compact Soundbar with Bluetooth and HDMI‑ARC Connectivity, Clear Dialogue, Dolby Atmos, Deep Bass, Remote Contro
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
Apple MacBook Air 13-inch with M5 Chip, 16GB Memory, 512GB SSD, Silver
As an affiliate, we earn on qualifying purchases.
What the City of Osaka confirmed
The city published its final report on the incident on November 13 at 13:00 Japan time, together with an apology page for users. The key line reads, in the original Japanese, 「利用者のメールアドレス 1,078,713 件」: users’ email addresses, 1,078,713 records. All quotes from Japanese sources in this article are our own translations.
Which addresses. The city defines them as the recipients of every email the system sent between July 1 and October 31, 2026: emails about user registration, changes of email address or password, logins, applications, status updates on applications and announcements. Its explanation for the high count: “Because a notice email was sent from the system to everyone registered as a user on Wednesday, September 16, 2026, the number is very large.” Read plainly, anyone who had an account on that day should assume their address is in the leak.
How the city knows. The addresses were identified “based on information that the provider of the external service gave to the system provider, which the system provider sorted and matched.” In other words, Arara handed TKC the stolen data, and TKC worked out which addresses belonged to Osaka’s users. TKC says it received the leaked addresses from Arara on November 4 and started sorting them by customer and system that day.
What the city will and will not do. Individual notices to affected users are “currently under consideration”. And: “we cannot answer inquiries about whether an individual email address is affected by this leak.” The city says it has asked TKC for a detailed report on the cause, the scope and the measures against a repeat. It will also re-examine “the handling of personal information in external services, safety management measures, and the system of cooperation with vendors.”
How it unfolded, step by step
The sequence below combines the city’s three press releases, TKC’s reports and the filings of Arara and its listed parent company, PayCloud Holdings. Times are Japan time.
- October 22: Arara Message is briefly taken offline, in TKC’s words for a response to a PHP vulnerability.
- October 27 and 28: Arara records what looks like reconnaissance on October 27. On October 28, an attacker logs in to the admin screen of a shared environment and copies data out, and Arara’s own service starts sending fake credit card emails. Arara confirms unauthorized access the same day.
- October 29: PayCloud discloses the breach: about 3.01 million addresses from one shared system. Arara reports to the police and sends a preliminary report to Japan’s Personal Information Protection Commission.
- October 30: TKC receives “a report that there was no information leak from TKC’s usage environment”.
- October 31: Arara finds that data was also carried out through its service, which the attacker had used between October 28 and 31 to get into many more servers. Arara shuts down the environment TKC uses for its local-government systems at 17:37, and from about 17:40 Osaka’s system can no longer send email. Arara completes the shutdown of its entire service at 19:53.
- November 2: Arara’s second report: about 77 million addresses taken through its service. TKC tells the city that users’ email addresses, names and other details may have leaked, and says up to 2,230,812 addresses of customers using its systems are in the leak.
- November 3 and 4: Osaka publishes its first two press releases. At about 10:00 on November 4, TKC reports that only email addresses were affected.
- November 6: Arara’s third report: 81,329,467 addresses after removing duplicates.
- November 13: Osaka confirms 1,078,713 addresses.
One correction to early coverage: The Record writes of a “November 2 cyberattack”. In Arara’s filings, November 2 is the date of its second report. The activity it describes runs from the apparent reconnaissance on October 27 to the shutdown on October 31.
Is “1 million” right?
Headlines, including The Record’s (“impacting 1 million”), round Osaka’s figure to a million. The city’s number is exact: 1,078,713. But it counts email addresses, not people, and the city gives no number of people. Arara makes the same point about its total: “The numbers are counts of email addresses, not of people.” The honest short version is: about 1.08 million email addresses.
The leak also reaches beyond Osaka. TKC sells online application, My Number card booking and emergency-contact systems to local governments. It said up to 2,230,812 addresses of customers using its systems were in the leak. By our count, Osaka’s 1,078,713 addresses alone are nearly half of that maximum.
A wave, not a one-off
Arara’s clients are now reporting one by one:
- Sega said on November 9 that 2,196,044 email addresses used for some of its newsletters leaked. It sends those newsletters through Arara.
- Japan’s Cabinet Office said on November 11 that 62,863 newsletter subscriber addresses leaked, 61,751 after removing duplicates.
- Osaka Prefecture, the regional government around the city, said on November 4 that the provider of its own online system had reported unauthorized access at an outside email delivery service, and that whether any addresses leaked was still being checked. It did not name the provider.
For some of Arara’s clients, the stolen data went beyond addresses: names, gender, dates of birth, phone numbers, membership numbers and home addresses, depending on what each client stored in the service. The service was also abused. Between October 28 and 30, up to about 7.13 million fake emails posing as credit card companies went out from news@arara.com. Arara says it does not hold credit card numbers.
Separately, Osaka Prefecture said on November 13 that an attacker had broken into the application system of its food-cost support program for children and students on October 17, through a weakness in a system maintained by a contractor it does not name. Identity document images of 12 people were exposed. The Record mentions this incident next to the city’s. The sources do not connect it to Arara.
The national picture is wider still. JPCERT/CC, Japan’s coordination center for computer security incidents, warned on October 8, 2026 that leaks of personal information through unauthorized access at Japanese organizations had been happening “one after another” in recent weeks, around September. In an analysis published on October 21, it said it had “confirmed that the attackers had used AI to scan for known vulnerabilities and carry out attacks via APIs”. JPCERT/CC did not link that finding to Arara, and no source we found does.
On November 6, Prime Minister Takaichi chaired a ministerial meeting on an emergency package of cybersecurity measures with four pillars. The cabinet had set aside approximately 10 billion yen from reserve funds that morning. “Even at this very moment, incidents of unauthorized access and information leaks continue to occur, significantly affecting people’s daily lives and business activities,” she said. Mihoko Matsubara, chief cybersecurity strategist at the telecom group NTT, told The Record that October alone saw 58% of all incidents reported in Japan this year.
What it means for businesses and public bodies
Osaka did not run the email service that leaked its users’ addresses. It hired TKC to run its online system. TKC hired Arara to deliver the emails. As in the Uber driver data breach through an AI vendor this week, the data leaked at a company the affected people never chose. Five lessons:
1. Your data map has to reach the last subcontractor. Ask every provider who actually sends your emails and where the recipient lists are stored. The city itself now says it will re-examine how personal information is handled in external services.
2. Delivery logs are a database. In Osaka’s case, what leaked was the list of everyone who received a system email. One bulk notice on September 16 put every user registered that day on that list. Ask your email provider how long it keeps recipient logs, and what it stores next to them. Some of Arara’s other clients lost names, dates of birth and home addresses because those fields were kept in the delivery service.
3. A breached sender becomes a phishing engine. Arara’s own service sent up to about 7.13 million fake credit card emails. The leaked addresses can be used the same way: Osaka, TKC and the Cabinet Office all warn of fake messages in their name. Prepare a warning in advance, and give users one simple rule. TKC and the Cabinet Office both state theirs: they never ask for passwords or credit card details by email.
4. Expect the numbers to change, and the first all-clear to be wrong. On October 30, TKC was told there was no leak from its environment. Three days later, up to 2,230,812 addresses linked to its systems were in the leak. The headline figure in Arara’s reports went from about 3.01 million to about 77 million to 81,329,467 in eight days. Plan your communication for revisions.
5. Keep a second way to send. Osaka’s system has not been able to send email since October 31. As of November 13, new user registration, email changes and password resets were still unavailable. TKC had to build a new sending platform before it could restart its services one by one.
Japan’s prime minister put the general point plainly on November 6: “We must not overlook supply chain risks associated with IT systems and equipment.”
What it means for people in Osaka
What leaked is an email address, plus the fact that it belongs to someone who uses the city’s online services. That is what a convincing fake needs: a message that looks like a city notice about an application, a login or a fee. The city’s warning covers exactly this: “even if an email claims to be from Osaka City or this system, do not open URLs or attachments in emails you do not recognize, and do not enter IDs, passwords, PINs, credit card information or similar.”
What to do now:
- Check whether you are affected. Search your inbox for mail from info-osaka-online@city.osaka.lg.jp between July 1 and October 31, 2026. If you find one, assume your address is in the leak. The city will not confirm individual addresses.
- Distrust unexpected city emails. No links, no attachments and no logins from a message you did not expect.
- Never pay because an email says so. The city’s own words: “do not respond to emails that ask for payment.”
- Go to the source yourself. “Check information on the Osaka City website and similar sources, not through links in the email.”
- Watch for the Arara fakes. If you received an email from news@arara.com between October 28 and 30 with a subject such as 「利用内容確認のご依頼」 (a request to confirm your usage) or 「ご利用明細確認のご依頼」 (a request to confirm your statement), Arara says: do not open the link and delete the email. If you entered card details, contact your card issuer right away.
According to TKC and the city, only addresses leaked from Osaka’s system, so the main risk is what lands in your inbox, not your city account.
What we don’t know
- How the attacker got in. Arara blames a vulnerability in a web server and problems in its system environment, and is still tracing the route with outside experts. TKC’s timeline shows the service was briefly stopped on October 22 for a PHP vulnerability response. Nobody has said whether that is related.
- Who is behind it. No source names a group. Arara says the series of intrusions appears to come from the same third party, judging by what the attacks had in common.
- How many people. Neither Osaka nor Arara gives a count of people.
- Whether Osaka’s addresses are being misused. The city does not say. Sega and the Cabinet Office said they had not confirmed misuse or concrete damage as of November 9 and 11.
- Whether residents will be told individually. The city says that is under consideration.
- When email returns. Osaka’s system still could not send email as of November 13. Arara says its own restart date is undecided.
- Whether AI played a role. JPCERT/CC has seen attackers in Japan’s breach wave use AI to scan for known vulnerabilities. No source ties that to Arara.
- The final numbers. Arara says it will need more time to confirm the count and the cause.
The bottom line
Osaka’s breach is a supply chain story. The city chose a provider, the provider chose a mail service, and the break-in happened at the end of that chain, outside the city’s own systems. For residents, the practical risk is phishing that looks like the city, so slow down before you click. For any organization that sends email through someone else, the question for this week is simple: who actually sends our emails, what do they keep, and how fast would we know if they were breached?
I’m Thorsten Meyer. The full sources are below, and more reality checks are at thorstenmeyerai.com.
Sources
- City of Osaka, Digital Integration Office (デジタル統括室): apology notice on the leak of email addresses from the Osaka City Administrative Online System, page 691479, November 13, 2026; press releases of November 3 (first report), November 4 (second report) and November 13, 2026 (final report); information page on the online system, November 13, 2026, city.osaka.lg.jp
- TKC Corporation: news releases on the unauthorized access at its email delivery contractor (first to sixth report, November 2 to November 9, 2026) and statement on media reports, November 6, 2026, tkc.jp
- Arara Inc.: second report (November 2, 2026) and third report (November 6, 2026) on the unauthorized access to its Arara Message service, and statement of apology, November 6, 2026, arara.com
- PayCloud Holdings: timely disclosures of October 29, November 2 and November 6, 2026
- Sega Corporation: notice on the leak at a contractor, November 9, 2026, sega.co.jp
- Cabinet Office of Japan: notice on the leak at its email delivery service, November 11, 2026, cao.go.jp
- Osaka Prefecture: press releases of November 4, 2026 (administrative online system) and November 13, 2026 (food-cost support program), pref.osaka.lg.jp
- Prime Minister’s Office of Japan: “Ministerial Meeting on Cybersecurity”, November 6, 2026 (provisional translation), japan.kantei.go.jp
- JPCERT/CC: alert JPCERT-AT-2026-0030 (published October 8, 2026, updated October 23, 2026) and “Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Infrastructure and Techniques”, JPCERT/CC Eyes, October 21, 2026
- The Record from Recorded Future News, Jonathan Greig: “City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents”, November 13, 2026
Researched and drafted with AI assistance, including Anthropic’s Claude. No company or public body named here reviewed or sponsored this article. Our own text and graphics contain no affiliate links; offer and product boxes added by the site may contain Amazon affiliate links. This article is for information only. It is not legal or security-consulting advice. Statements as published by the City of Osaka, TKC, Arara, PayCloud Holdings, Sega, Japan’s Cabinet Office, Osaka Prefecture, the Prime Minister’s Office and JPCERT/CC, and as reported by The Record, as of November 14, 2026; quotes from Japanese sources are our own translations. Check the City of Osaka’s notice for later updates. Images: AI-generated illustration (Runware) and graphics by Thorsten Meyer AI; no real people or logos are shown in them. Boxes added by the site may show product photos or people.
