Osaka confirms nearly 1.08 million email addresses leaked after a mass notice widened exposure

Osaka confirmed on November 13 that 1,078,713 email addresses belonging to users of its online administrative system had leaked. The affected addresses received system emails between July 1 and October 31. A September 16 notice sent to registered users explains the unusually large count, the city said. The count reflects notification reach, rather than simply the volume of recent applications.

The intrusion affected an outside email service. In its first notice, Osaka said its system supplier TKC used Arara for email delivery. TKC reported a possible disclosure to the city on November 2. Emergency maintenance intended to contain the damage had stopped the administrative system sending email from the evening of October 31. Registration, email-address changes and password resets were consequently disrupted. The maintenance carried the disruption from an outside supplier into residents’ administrative tasks.

The description of exposed information was subsequently narrowed. On November 4, Osaka relayed investigation findings that the affected information was email addresses, while message bodies, My Number identifiers and application information had not leaked. No unauthorized access to the administrative system or TKC's data center had been identified at that point. The new development on November 13 was a confirmed count for Osaka, replacing an exposure still under investigation. The scale is substantial, but the disclosed data category remains contact addresses.

A separate municipal service was affected too. Osaka's 2026 premium shopping-voucher program reported 33,868 user email addresses and 14,669 participating-shop addresses exposed. A different contractor consortium ran that program and also used Arara's email service. These are separate address counts; the announcements provide no deduplicated total across the programs. The voucher program reported no identified intrusion into the system managing users and participating shops.

The broader lesson is that a public service's security boundary extends to the companies sending its notifications. Residents see the city at the front end, while several systems may handle the work behind it. An email address is a delivery destination, but it is also a route for a convincing fake notice to arrive. People accustomed to progress updates and account alerts have reason to scrutinize unexpected requests to pay, act urgently or sign in again. For public agencies, reviewing a supplier list is only the start. The practical questions include who retains recipient addresses, for how long, how an incident's scope will be established and how essential messages will resume. The million-address figure draws attention to those easily overlooked dependencies.

Official final report published: November 13, 2026, 12:00 Beijing time; November 12, 2026, 23:00 US Eastern Standard Time (EST).