The City of Osaka has confirmed that 1,078,713 email addresses belonging to users of its online administrative services system leaked to an attacker. The system handles requests such as copies of resident records. The city's own system was not breached. The attacker got in through Arara Message, an email delivery service run by Arara Inc., which TKC Corporation, the city's system provider, used to send notifications. Headlines describe the incident as affecting about 1 million people. The city's final report, published on 13 November, is more precise: 1,078,713 is a count of email addresses, not a count of distinct people. The Record described the total as "more than 1 million email addresses." On the same day the city disclosed a second, smaller leak from the same upstream breach. That one exposed 33,868 user addresses and 14,669 participating-shop addresses from its 2026 Premium Gift Voucher programme.
What Happened
The city learned of the problem from TKC on 2 November and published three updates:
- 3 November (first report): The city said Arara's email delivery service, used by TKC, had been accessed without authorisation on 31 October and placed under emergency maintenance. It said email addresses and possibly names might have leaked, with no count yet. No intrusion into the city's system itself or TKC's data centre had been found.
- 4 November (second report): Arara's investigation narrowed the exposure to email addresses only. Email bodies, My Number national ID numbers and application data were not included.
- 13 November (final report): The city confirmed the leak and set the count at 1,078,713 addresses.
Affected addresses are those that received any email from [email protected] between 1 July and 31 October 2026. That covers registration confirmations, address and password changes, login alerts, application status updates and general notices. The count is so high because of a single message: on 16 September the city sent a notice to every registered user. As LiveMakers put it, sending one bulk notice extended the exposure to the city's entire user base.
TKC identified the affected addresses by sorting and matching data that Arara supplied. The city then reviewed the result. The city says it will not confirm whether any specific address is affected, and it is still deciding how to notify people individually. As of the final report, the system still cannot send email, according to the city and CNET Japan. New registrations, email address changes and password resets are unavailable. Other functions work.
Accounts differ on timing. The Record reports that Arara put the attack at 2 November. Arara's third report, as summarised by LiveMakers, says an outside party was inside Arara's cloud environment from 28 to 31 October. The city's first report also gives 31 October as the date of unauthorised access. TKC told the city about the problem on 2 November, which may explain The Record's date.
What Was Taken
- Osaka administrative online system: 1,078,713 email addresses, according to the city's final report and repeated by CNET Japan, Security Measures Lab and LiveMakers. The Record reports "more than 1 million." Both the city and Security Measures Lab warn that the figure counts addresses, not unique individuals.
- Osaka Premium Gift Voucher 2026: 33,868 user addresses and 14,669 shop addresses, according to a separate city press release. These were tied to emails sent from July 2026 onward through a different contractor that also used the compromised service. Some addresses received more than one message, so the totals do not match per-mailing send counts.
- Not taken, according to the city: email bodies, My Number IDs, names, home addresses or application contents. The city's first report raised the possibility that names were exposed. The second report ruled that out.
The upstream totals are larger, and reports disagree on them. The Record reports that Arara said 77 million email addresses from nearly 400 customers were exposed, including TKC and Sega. LiveMakers, citing Arara's 6 November third report, gives 81,329,467 deduplicated addresses across up to about 380 client companies. Security Measures Lab cautions that adding Arara's total to Osaka's figure would count the same addresses twice.
Why It Matters
The contractor's contractor was the weak point. The city did not hold a contract with Arara. Its system provider did. LiveMakers describes Arara as a second-tier subcontractor that was hard for the city to see. Even so, it held a delivery list covering most of the city's digital service users. Defenders should assume that their notification and messaging providers keep copies of user contact lists, and that these copies sit outside their own controls.
A list of addresses is still a targeting asset. Every address on this list belongs to someone who used Osaka's online government services. Phishing that pretends to come from the city or from a specific procedure will look credible to these people. Arara also reported that the attacker used its own platform to send phishing emails while they had access. The Record says millions were sent, imitating credit card companies and financial institutions. LiveMakers, citing Arara's second report, puts the figure at up to about 7.13 million. Because those messages came from a legitimate bulk-mail provider, they may have passed sender-authentication checks.
The pattern is spreading across Japan. LiveMakers reports that the same Arara breach exposed 62,863 addresses from a Cabinet Office newsletter and knocked out Yokohama's electronic application login. ITmedia separately reported on a breach at Arcadia, an Osaka Prefecture-based provider of disaster alert emails for local governments. That breach began on 11 October, followed a similar path, and ended with a backdoor sending about 1.42 million credit card phishing emails. The Record also notes that Osaka Prefecture disclosed its own breach days earlier, involving food support programme participants. It adds that Prime Minister Sanae Takaichi announced emergency cybersecurity measures after months of attacks on companies including Japan Airlines, Sony Network Communications and Capcom.
Particle separately reports that the City of Osaka took several websites and online systems offline as a precaution after a critical PHP vulnerability was disclosed, and that it found no confirmed unauthorised access. No public source links that suspension to the Arara breach.
The Attack Technique
What is known comes from Arara's own disclosures as reported by others. Arara's third report, as summarised by LiveMakers, says an outside party misused authentication credentials to enter Arara's cloud environment between 28 and 31 October and copied email addresses out. The attacker then used the delivery platform to send phishing emails. Arara Message has been fully offline since 31 October, with no restart date, and Arara has not yet published how the credentials were obtained.
The city and TKC say they found no intrusion into the Osaka administrative online system or TKC's data centre. The exposure was limited to the address data held by the email provider.
The Arcadia incident is a separate case, but ITmedia's minute-by-minute account shows how these attacks can unfold. The attacker exploited a path traversal flaw on a media server to read config.ini. They took a service-to-service secret key from it and used that key to brute-force account IDs. After the original entry point was closed, a backdoor and a newly added WordPress plugin let them start mass-sending phishing emails about 21 hours later. Nobody has publicly linked the two incidents.
What Organizations Should Do
- Map your fourth parties. Ask every system integrator which outside email, SMS and push notification providers they use. Require that list in contracts, along with a duty to tell you about breaches at those providers.
- Limit what notification providers keep. Contracts should require short retention periods for recipient lists and delivery logs. Osaka's exposure covered four months of recipients, and one bulk mailing made that equivalent to its whole user base.
- Think twice before mailing your entire user base. Every bulk notice sent through an outside provider copies your full contact list to that provider. Where possible, use in-portal notices or self-hosted delivery for low-priority announcements.
- Plan for phishing that impersonates you. Publish your genuine sender addresses. Enforce DMARC at
p=rejecton every domain you own. Tell users plainly that you will never ask for payment or credentials by email. Osaka did this, but only after the leak. - Treat notification-platform credentials as high-value. For SaaS delivery accounts, require MFA, IP allow-listing and short-lived API keys, and alert on unusual sending volume. Both Arara and Arcadia were used to send mass phishing from inside the platform.
- Have a notification plan for when you cannot email people. Osaka's email function is still down, it has no confirmed way to tell individuals they are affected, and it won't confirm whether a given address is included. Decide your fallback channels before you need them.
Sources: City of Osaka warns of data breach impacting 1 million as Japan ree... | 大阪市、行政オンラインシステムのメールアドレス107万8,713件が情報漏えい アララへの不正アクセス、11月13日終報で確定セキュリ... | 📡 Signal｜大阪市の行政オンライン、アララ経由で107万件のアドレス漏えい LiveMakers | 「侵入経路塞いだが、バックドアから……」不正アクセス105時間の攻防、分単位で報告 防災メールのアルカディア - ITmedia NEWS | 大阪市：報道発表資料 大阪市プレミアム付商品券2026事業において利用するメール配信サービスでの情報漏えいについて（終報） | 大阪市：【大阪市行政オンラインシステム】メール配信サービスへの不正アクセスによるメールアドレスの情報漏えいについて（お詫び） （…>行... | Particle: Osaka City Suspends Multiple Websites After Critical PHP... | 大阪市、メアド107万8713件流出 - CNET Japan