Osaka city said hackers gained access to an email distribution service and exposed more than 1 million email addresses, as Japan deals with a wave of cyber incidents.
The service, called Arara, is used by TKC Corporation, the company contracted to maintain the city’s online administrative services platform. Anyone who received an email from the city’s system between July 2026 and October 31 had their address leaked. The city’s notice was reported on Friday, November 13.
The city warned its 2.8 million residents to be wary of suspicious emails claiming to come from the city. It advised people not to open links or attachments in such messages.
Arara said a cyberattack on November 2 exposed 77 million email addresses belonging to nearly 400 customers, including TKC and the game company Sega. Hackers used the service to send millions of malicious emails that impersonated credit card companies and financial institutions.
Other Japanese organizations, including Japan Airlines, Sony Network Communications and Capcom, have also disclosed cyber incidents in recent weeks.
Prime Minister Sanae Takaichi held a cabinet meeting on cybersecurity and announced emergency measures covering AI-based cyber defense, better information gathering, offensive cyber operations and support for breach victims. About $62 million in emergency funds was set aside, and companies were urged to report cyberattacks to government agencies more quickly. Takaichi said the government should mobilize its full resources.
