Arara email platform breach: City of Osaka — third-party email service hack exposed 1M+ resident email addresses (no CVE)
Severity: medium · Patch status: no-fix-needed · Since 2026-11-13
The City of Osaka, Japan's third-largest city, disclosed a data breach exposing over 1 million email addresses tied to its online administrative services platform. Attackers compromised the Arara email distribution service operated for contractor TKC Corporation; anyone emailed by the city system between July 2026 and October 31 had their address leaked. Arara said a November 2 cyberattack exposed 77 million email addresses from nearly 400 customers, including TKC and Sega, and that hackers abused the service to send millions of phishing emails impersonating credit card companies and financial institutions. The breach follows a wave of cyberattacks across Japan, prompting a government emergency cybersecurity package. No fix applies; residents are warned to avoid suspicious links and attachments.
What to do
- Warn users that email addresses were exposed and phishing emails impersonating the city and financial institutions are likely
- Block and filter known malicious URLs/attachments from the phishing campaign
- Review third-party email and notification service integrations and their access to customer data
- Monitor for credential-theft and fraud attempts targeting affected users
- Accelerate incident reporting to national CSIRT per new Japanese government guidance
Sources
All live incidents on Threat Watch
