Osaka warns 2.8 million residents: Arara email breach exposes more than 1 million addresses

Osaka notified the public that a third-party technology provider breach at Arara, an email service operated by TKC Corporation, exposed more than 1 million email addresses for users of the city’s online administrative services platform. The city said the exposure covered anyone who received an email from the city’s system between July 2026 and October 31. Hackers accessed Arara, which TKC Corporation operates for Osaka’s administrative platform. Malicious e-mails posing as banks and financial firms went out through Arara’s email distribution service, the company noted.

Nearly 400 customers, including TKC and gaming giant Sega, lost 77 million e-mail addresses in a Nov. 2 cyber attack on Arara, the company said. The Arara attack created a cascading effect for many large businesses and governments across Japan. Osaka Prefecture’s regional government announced its own data breach involving food support program participants days before the city’s disclosure. Months of cyber attacks have hit critical companies and institutions in Japan, with Japan Airlines, Sony Network Communications and Capcom among them.

Japanese Prime Minister Sanae Takaichi held a cabinet meeting on cybersecurity last week. The meeting produced emergency measures covering AI for cyber defense, robust information gathering, offensive cyber attacks and support for data breach victims. The effort received about $62 million in emergency funds, and government agencies asked companies to report cyber attacks faster. Sanae Takaichi said, “Let us mobilize the full resources of the government to strengthen Japan’s overall capabilities to respond to cyberattacks.”

Mihoko Matsubara, chief cybersecurity strategist at Japanese telecom giant NTT, said data showed cyber attacks on Japanese systems began rising in July and surged through October. October accounted for 58% of all reported incidents in Japan this year, Matsubara said. Her background includes work for Japan’s Ministry of Defense and other government cybersecurity committees. Matsubara said the recent breach surge followed new cybersecurity legislation allowing more robust government action during significant cyber attacks.

The key point of last week’s government initiatives is that organizations alone cannot handle cybersecurity, Matsubara said. Security assessments and recovery support from the government can make a difference when needed, she said. The money must start a consistent longer-term effort rather than serve as a one-time fix for the current attacks, she said. Other countries are watching how quickly and forcefully Japan responds to cyber attacks, she said.

About 380 million personal data pieces were stolen this year, Matsubara said. Matsubara said Japanese personal information is already sold on the dark web, with some used for fraudulent securities trades. Actors with money could build a database covering Japanese citizens’ socioeconomic activity and personal preferences, Matsubara warned.

A study released three weeks ago by Japan’s national Computer Security Incident Response Team showed attackers use AI to check for known flaws prior to attacks. Matsubara said recent breaches appear to involve AI tools such as Claude and Artex that help cybercriminals find and exploit bugs. Matsubara said AI cannot be blamed for every breach in the current wave.

Osaka told its 2.8 million residents to watch for suspicious e-mails claiming to come from the city. Residents should not open any URLs or attachments in these messages, the city said.