City of Osaka Warns Data Leak Hit 1 Million Email Addresses
The City of Osaka said hackers who breached a contractor's email service exposed more than 1 million addresses. Officials told the city's 2.8 million residents not to open links or attachments in suspicious emails, as Japan faces a wave of cyberattacks and emergency government measures.
The City of Osaka, Japan's third-largest city, has warned residents that a data breach at a third-party technology provider exposed more than 1 million email addresses linked to an online administrative services platform. The city published its notice on or before November 14, 2026.
Residents should be alert. The city urged all 2.8 million of them not to open URLs or attachments in suspicious emails that claim to come from the city.
What was exposed
According to the city's statement, hackers accessed the Arara email distribution service used by TKC Corporation. TKC is the company contracted to maintain Osaka's administrative services platform.
Anyone who received an email from the city's system between July 2026 and October 31 had their address leaked, the city said.
A wider attack on Arara
Arara said a November 2 cyberattack exposed 77 million email addresses from nearly 400 customers. They include TKC and the gaming company Sega, among others.
The company also said hackers used its email service to send millions of malicious emails posing as credit card companies and financial institutions.
The city's breach followed days after the Osaka Prefecture regional government announced its own leak, involving information on participants in a food support program.
Japan's response
Japan has faced months of attacks on major organizations, including Japan Airlines, Sony Network Communications and the game maker Capcom.
Last week, Prime Minister Sanae Takaichi held a cabinet meeting on cybersecurity. She announced emergency measures to expand the use of AI in cyber defense, strengthen information gathering, allow offensive cyber operations and give more support to breach victims. About $62 million in emergency funds was set aside, and companies were urged to report attacks to government agencies faster.
"Even at this very moment, incidents of unauthorized access and information leaks continue to occur, significantly affecting people's daily lives and business activities," Takaichi said.
Japan's national Computer Security Incident Response Team published a study three weeks ago. It found evidence that attackers are using AI to scan for known vulnerabilities before striking.
Expert view
Mihoko Matsubara, chief cybersecurity strategist at the telecom company NTT, said attacks on Japanese systems began to grow in July and surged through October. October accounted for 58% of all reported incidents this year, she said. About 380 million pieces of personal data have been stolen so far in 2026.
Matsubara said a large amount of Japanese personal data is already traded on the dark web, and some has been used in fraudulent securities transactions. She warned that well-funded attackers could build a detailed database of citizens' economic activity and preferences.
She said the recent breaches appear to involve AI tools such as Claude and Artex, which help criminals find and exploit software bugs. Not every breach in this wave can be blamed on AI, she argued.
The surge followed new cybersecurity legislation that lets the government take stronger action after a major attack. "Many countries would be keen to learn how quickly Japan would respond to which kinds of cyberattacks, and with what level of intensity," Matsubara said.
