Osaka says third-party email breach exposed over 1 million addresses
Original title: City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents
Arara says a November 2 attack exposed 77 million addresses from nearly 400 customers, including Sega and TKC.
The city of Osaka said hackers accessed the Arara email service used by contractor TKC, leaking addresses of people emailed by the city system from July 2026 through October 31. Osaka told its 2.8 million residents not to open links or attachments in messages claiming to be from the city. Arara said the November 2 attack exposed 77 million addresses from nearly 400 customers and that attackers sent millions of emails posing as financial institutions. Osaka Prefecture had separately disclosed a breach of food-support participant data.
Unconfirmed: Matsubara said recent breaches appear to involve tools such as Claude and Artex, while arguing AI does not explain every incident.
- Prime Minister Sanae Takaichi announced emergency cyber measures and about $62 million in funds.
- NTT's Mihoko Matsubara said October held 58% of Japan's reported incidents this year.
- She said about 380 million pieces of personal data were stolen so far this year.
- Japan's CSIRT reported attackers using AI to scan for known vulnerabilities.
Impact: More than 1 million city email addresses were exposed.
- 1.Do not open URLs or attachments in emails claiming to be from the city of Osaka.
- ATT&CK
- T1566 Phishing
- Vendors
- Arara
- Products
- Arara email distribution service
- Countries
- Japan
From the original article
3 min read at therecord.mediaOsaka, Japan's third-largest city, told its 2. 8 million residents to be wary of suspicious emails purporting to come from the local government.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.