Osaka says attackers exposed 1 million email addresses via third-party service

The City of Osaka said attackers accessed Arara, an email distribution service used to send mass notifications, operated by TKC Corporation, a vendor maintaining the city's online administrative services platform. The compromise exposed more than 1 million email addresses tied to people who received city emails between July and Oct. 31, according to a municipal statement. Osaka, Japan's third-largest city with about 2.8 million residents, told the public not to open links or attachments in messages claiming to come from the city.

The disclosure followed Arara's notice that a Nov. 2 cyberattack exposed 77 million email addresses from nearly 400 customers, including TKC and Sega. Arara said attackers used its email distribution service to send millions of malicious messages impersonating credit card companies and financial institutions. The Osaka breach also came days after Osaka Prefecture reported a separate leak involving participants in a food support program, showing municipal systems were exposed through different vendors and channels.

Japan's national incident response team said it found evidence attackers used AI to scan known vulnerabilities before attacks, while NTT strategist Mihoko Matsubara said reported incidents began rising in July and surged through October, with October accounting for 58% of incidents this year. She said about 380 million pieces of personal data have been stolen this year, after attacks on Japan Airlines, Sony Network Communications and Capcom, but not every breach can be attributed to AI. Prime Minister Sanae Takaichi announced emergency measures, including about $62 million for AI-enabled defense, information gathering, offensive cyber operations and faster breach reporting.

The exposure matters because email addresses are low-value individually but useful for phishing at scale, especially when tied to government services. Arara's role as a shared vendor means one compromise can cascade across public agencies and private firms, including Sega and TKC. For Osaka's 2.8 million residents, the risk is targeted fraud: messages that appear official can lure people into clicking malicious links or revealing credentials. The volume of stolen data already circulating on the dark web raises the risk of follow-on scams.