Osaka: A cyberattack on a third-party email service exposed 1,078,713 email addresses connected to Osaka’s online administrative services platform, prompting city officials to warn residents about suspicious messages impersonating government agencies.
The City of Osaka confirmed the breach on November 13 after its technology provider, TKC Corporation, reported unauthorized access to an external email distribution service operated by Arara.
The exposed information consists of email addresses belonging to people who received messages from the city’s administrative online system between July 1 and October 31, 2026.
Those messages included account registrations, email address changes, password updates, login notifications, administrative applications and updates about the processing of requests submitted through the platform.
Osaka officials explained that the number of affected addresses was particularly high because the system sent a notification email to all registered users on September 16.
The Japan cyber attack did not involve a confirmed intrusion into the city’s own administrative platform. Instead, hackers accessed the external email distribution service used by TKC to operate communications for the system.
The city warned that criminals could exploit the exposed addresses to send fraudulent emails pretending to represent Osaka’s government or its online services.
Residents were advised not to open unexpected links or attachments, disclose passwords or payment information, or respond to messages demanding money. Officials urged users to verify information through the city’s official website.
The affected emails came from the address [email protected]. Residents can review their inbox history to determine whether they received messages from the system during the affected period.
The city said it was seeking a detailed report from TKC covering the cause of the unauthorized access, the full impact and measures intended to prevent another incident.
The breach followed a November 2 cyberattack against Arara’s email distribution service. The company said the incident exposed 77 million email addresses associated with nearly 400 customers, including TKC and gaming company Sega.
Arara’s service was also misused to distribute millions of malicious emails impersonating credit card companies and financial institutions, according to the company’s disclosures reported by The Record.
Japan has experienced a growing series of cyber incidents affecting major companies and public institutions, including Japan Airlines, Sony Network Communications and video game publisher Capcom.
Prime Minister Sanae Takaichi recently announced emergency cybersecurity measures, including greater use of artificial intelligence for cyber defense, improved information gathering and additional support for organizations affected by data breaches.
The government also allocated approximately $62 million in emergency funding and urged companies to report cyber incidents more quickly to authorities.
