WORLDTECHOsaka city warns 2.8 million residents of email address leak and phishing risk
The city of Osaka has told its 2.8 million residents that the email addresses of everyone who received email from its system between July 2026 and October 31 were leaked, and has cautioned them against suspicious messages claiming to come from the city. The disclosure came days after the regional government of Osaka Prefecture reported a data breach of its own.
What the city says was exposed
According to the city, the email addresses of anyone who received a message from the system it runs between July 2026 and October 31 were leaked. Residents have been asked not to open any URLs or attachments in emails that appear to originate from the local government.
The account of the leak and the warning comes from a single outlet, The Record, and reflects the city's own statement.
Breach follows prefecture incident
The city's notice came days after the Osaka Prefecture government announced a breach in which data leaves an organisation without permission. That incident involved the information of participants in a food support program.
Osaka is Japan's third-largest city.
Wider wave of cyber incidents in Japan
Hackers gained access to the Arara email distribution service, which is used by TKC Corporation, the company contracted to maintain the administrative services platform, according to a statement from the Osaka city government. Arara said a cyberattack on November 2 exposed 77 million email addresses from nearly 400 customers, among them TKC and the gaming company Sega. Arara also noted that its email distribution service was used to send millions of malicious emails pretending to be from credit card companies and financial institutions.
Last week Japanese Prime Minister Sanae Takaichi chaired a cabinet meeting on cybersecurity and announced emergency measures covering greater use of AI in cyber defence, more robust information gathering, offensive cyberattacks and increased support for data breach victims. About $62 million in emergency funds has been dedicated to the effort, and companies have been urged to report cyberattacks more quickly to government agencies.
Japan's national Computer Security Incident Response Team published a study three weeks ago finding evidence that attackers use AI to scan for known vulnerabilities before carrying out attacks in the country. Mihoko Matsubara, chief cybersecurity strategist at the telecom company NTT, told The Record that cyberattacks on Japanese systems began to grow in July and skyrocketed through October, which accounted for 58% of all reported incidents in Japan this year. She argued that not every breach in this wave can be attributed to AI.
What is confirmed and what is not
The leak and the warning rest on the city's statement. The available facts do not establish a link between the Arara incident and the Osaka city breach, and Matsubara cautions against attributing the entire wave to AI.
Open questions
- Which systems and records beyond email addresses were affected in the city breach?
- Has the Arara service been confirmed as the source of the Osaka city leak?