Osaka Data Breach Exposes 1M Emails via Arara Hack
The city of Osaka says more than 1 million email addresses of its online services users leaked after hackers breached Arara, the email delivery service used by its platform vendor TKC.
⚡ Why it matters
It is a textbook supply chain incident: one compromised provider exposed data for hundreds of customers and was used to send phishing that impersonated banks and card issuers.
Osaka, Japan's third-largest city, warned that more than 1 million email addresses were exposed. The breach did not hit city systems directly. Attackers got into Arara, an email distribution service used by TKC Corporation, which runs the city's administrative services platform.
Who is affected
According to the city, anyone who received an email from the platform between July 2026 and October 31 had their address leaked. Officials told the city's 2.8 million residents to be wary of messages claiming to come from the city and to avoid opening links or attachments.
The bigger incident
Arara said a November 2 attack exposed 77 million email addresses belonging to almost 400 customers, including Sega. The attackers also abused the service to send millions of phishing emails posing as card companies and financial institutions.
Japan has faced months of cyberattacks on major companies. Prime Minister Sanae Takaichi announced an emergency package of about $62 million to strengthen cyber defense, including AI-based protection.
What to do
- Treat unexpected emails asking for payment details with suspicion, even when they look official.
- If your company uses a third-party email sender, review its access and confirm SPF, DKIM and DMARC are set correctly.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.