// AI threat desk · 15 Nov 2026
Home/LEAK · Data Leaks
Data LeaksMediumEMAILCVSS not assigned

Arara email service breach exposed more than 1 million Osaka addresses

The City of Osaka said a data breach involving a third-party technology provider exposed more than 1 million email addresses tied to its online administrative services platform.

· 2 min read
AI-generated image of a municipal security worker reviewing blurred email records on computer monitors.
AI-generated image, not a photo of the event.
Key takeaways
  • The City of Osaka said more than 1 million email addresses were exposed through a third-party technology provider.
  • The affected addresses belonged to people who received emails from the city system between July 2026 and October 31.
  • Arara said the wider November 2 cyberattack exposed 77 million addresses from nearly 400 customers.

The City of Osaka said a breach involving Arara’s email distribution service exposed more than 1 million email addresses connected to an online administrative services platform.

Anyone who received an email from the city’s system between July 2026 and October 31 had their address exposed, the city said.

Arara said a November 2 cyberattack exposed 77 million email addresses belonging to nearly 400 customers, including TKC and Sega. Hackers also used the service to send millions of malicious emails pretending to be from credit card companies and financial institutions, it said.

On this page

Japan’s cyber response is expanding as breaches rise

Japan’s national Computer Security Incident Response Team said it found evidence that attackers were using AI to scan for known vulnerabilities before attacks in Japan.

Japanese Prime Minister Sanae Takaichi held a cabinet meeting on cybersecurity and announced emergency measures including greater use of AI for cyber defense, more robust information gathering, offensive cyberattacks and increased support for data breach victims.

Mihoko Matsubara said AI may be involved in recent breaches

Mihoko Matsubara said recent breaches appeared to involve AI tools including Claude and Artex. She also said not every breach in the wave could be attributed to AI.

The city warned its 2.8 million residents to be wary of suspicious messages claiming to come from the city and not to open URLs or attachments.

The city breach came days after the Osaka Prefecture government announced its own data breach involving food support program participants’ information.

What to do now

  1. Be wary of suspicious emails purporting to come from the city and do not open any URLs or attachments.

FAQ

What happened in the Osaka email breach?

The City of Osaka said a breach involving Arara’s email distribution service exposed more than 1 million email addresses tied to an online administrative services platform.

Who was affected by the Arara breach?

People who received an email from the Osaka system between July 2026 and October 31 had their email addresses exposed, the city said.

How many email addresses did the wider Arara attack expose?

Arara said the November 2 cyberattack exposed 77 million email addresses from nearly 400 customers, including TKC and Sega.

Sources

  1. City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents, The Record
How we checked this story
ClaimSourceStatus
The City of Osaka said addresses of anyone receiving an email from the system between July 2026 and October 31 were leaked.City of Osaka, via The RecordAttributed
Arara said a November 2 cyberattack exposed 77 million email addresses from nearly 400 customers, including TKC and Sega.Arara, via The RecordAttributed
Arara said hackers used its email distribution service to send millions of malicious emails pretending to be from credit card companies and financial institutions.Arara, via The RecordAttributed
Japan’s national Computer Security Incident Response Team said it found evidence attackers were using AI to scan for known vulnerabilities before attacks in Japan.Japan’s national Computer Security Incident Response Team, via The RecordAttributed
Mihoko Matsubara said recent breaches appeared to involve AI tools including Claude and Artex, but not every breach could be attributed to AI.Mihoko Matsubara, via The RecordAttributed

Could not verify

  • Whether the exposed email addresses were used in further attacks is not established
  • Whether the breach was exploited by a named threat actor is not established
  • Whether a CVE was assigned is not established
  • How many Osaka residents were directly affected is not established
See all in Data Leaks →
Explore with AI
ChatGPT
Claude
Perplexity
Grok