City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents
City of Osaka discloses breach affecting 1M email addresses via compromised third-party platform.
The City of Osaka announced a data breach affecting over 1 million email addresses through a compromised Arara email distribution service maintained by TKC Corporation. The November 2 attack on Arara exposed 77 million email addresses from nearly 400 customers including Sega and other major Japanese businesses and governments, with hackers using the service to send phishing emails impersonating financial institutions. The incident is part of a broader wave of cyberattacks across Japan, where October 2026 accounted for 58% of all reported incidents that year, with approximately 380 million pieces of personal data stolen.
AI summary of the linked source. Not reviewed by an editor. How this works
Run TKC Corporation?
Get an email when a new story names TKC Corporation, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe City of Osaka and nearly 400 other organizations suffered a significant data breach because they relied on a shared third-party email distribution service, Arara, operated by TKC Corporation, without adequate oversight of that vendor's security posture. When attackers compromised Arara, they gained a single point of access to data belonging to all customers simultaneously, amplifying the blast radius dramatically. The compromised service was then weaponized to send phishing emails impersonating financial institutions, turning the breach into an active attack vector against end users. This incident illustrates the cascading risk that emerges when organizations outsource critical communication infrastructure without enforcing contractual security standards or conducting regular vendor audits.
What helps against this
How we list vendors- Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Claude
- malware — Artex