Osaka city online services hit by Arara mail-service breach, over 1.07 million user emails leaked

Osaka City said in its Nov 13 final report that an external mail-delivery service used by its administrative online system was accessed without authorization, confirming 1,078,713 user email addresses leaked, covering addresses that received system emails between Jul 1 and Oct 31, 2026 ^[1]. The city earlier said only email addresses were leaked, not email bodies, My Number or application data, and no intrusion into the city system or provider TKC's data center was found; The Record says the breached service was the Arara email distribution service used by TKC ^[2][3]. What to do now: Osaka asks users to check whether they received mail from info-osaka-online@city.osaka.lg.jp in that period, not to open links or attachments in suspicious emails or enter credentials or card details, and not to respond to payment demands ^[1].

Industries mainly affected: Government

1. Check whether you received mail from info-osaka-online@city.osaka.lg.jp between Jul 1 and Oct 31, 2026 .