Overview
The City of Osaka, Japan's third-largest city, says a breach at a third-party provider exposed more than 1 million email addresses tied to an online administrative services platform. The city has 2.8 million residents and has told them to be wary of suspicious emails that appear to come from the local government.
What Happened
- Attackers accessed Arara, an email distribution service used by TKC Corporation, which maintains the platform for the city.
- Anyone who received an email from the city's system between July 2026 and October 31 may have had their address exposed.
- The only data reported exposed is email addresses.
- Arara reported that its attack on November 2 exposed about 77 million addresses from nearly 400 customers, including TKC and gaming company Sega.
- Attackers also used Arara's service to send millions of malicious emails posing as credit card companies and financial institutions.
Days earlier, Osaka Prefecture separately reported a breach involving information about food support program participants.
Wider Context in Japan
The incident lands during a heavy stretch for Japanese organizations. Companies and institutions hit recently include Japan Airlines, Sony Network Communications and Capcom. Prime Minister Sanae Takaichi held a cabinet meeting on cybersecurity in early November and announced emergency measures covering AI-based cyber defense, information gathering, offensive cyber capabilities and victim support, backed by about $62 million in emergency funds.
NTT's Mihoko Matsubara said attacks rose from July and surged through October, which accounts for 58% of reported incidents this year. Roughly 380 million pieces of personal data have been stolen so far in 2026, and some of it is being sold on the dark web and used for fraudulent securities transactions. Japan's CERT found evidence that attackers use AI to scan for known vulnerabilities, though not every breach can be attributed to AI.
Recommended Actions
- Residents: Do not open links or attachments in emails claiming to be from the city. Go to official sites directly.
- Organizations: Inventory third-party email and messaging providers that hold your contact lists, and ask for breach notification terms.
- Security teams: Expect convincing phishing that reuses real government or vendor branding, and brief staff and customers accordingly.
- Mail filtering: Tighten SPF, DKIM and DMARC enforcement for your own domains so lookalike mail from a compromised sender is easier to spot.