The City of Osaka has reported a significant data breach involving the leak of 1,078,713 email addresses from its online administrative system. This incident is linked to a breach of Arara, an email delivery service, which exposed approximately 77 million email addresses from nearly 400 clients.
The breach, which occurred on November 2, has led to the use of Arara's infrastructure by attackers to send up to 7.13 million fraudulent messages, impersonating credit card companies. The City of Osaka has advised residents to be cautious and avoid opening links or attachments in unexpected emails claiming to be from the city.
This incident is part of a broader increase in cyberattacks in Japan. In October 2026 alone, there were 233 publicly disclosed security incidents, accounting for 58% of the year's reported incidents.
In response to the surge in cyberattacks, the Japanese government has announced a 10 billion yen emergency cybersecurity package. Meanwhile, Osaka has ordered TKC Corporation to provide a detailed report on the cause, scope, and potential fixes related to the breach.