[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7-vu8hWXk9SBdcCAy8dMrMqAsn9kXnGPlEyctC4izxk":3},{"article":4,"iocs":52,"watch_terms":59,"solutions":60,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"4838b4f5-5aa4-4740-92f0-ff72916c7414","City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents","city-of-osaka-warns-of-data-breach-impacting-1-million-as-japan-reels-from-dozen-72ccdc","Osaka, Japan's third-largest city, told its 2.8 million residents to be wary of suspicious emails purporting to come from the local government.","The City of Osaka announced a data breach affecting over 1 million email addresses through a compromised Arara email distribution service maintained by TKC Corporation. The November 2 attack on Arara exposed 77 million email addresses from nearly 400 customers including Sega and other major Japanese businesses and governments, with hackers using the service to send phishing emails impersonating financial institutions. The incident is part of a broader wave of cyberattacks across Japan, where October 2026 accounted for 58% of all reported incidents that year, with approximately 380 million pieces of personal data stolen.","City of Osaka discloses breach affecting 1M email addresses via compromised third-party platform.","https:\u002F\u002Ftherecord.media\u002Fcity-of-osaka-japan-email-data-breach","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002FOsaka_City_Hall_2026_19ba5dd07a.jpg","2026-11-13T19:43:00+00:00","2026-11-13T20:00:10.8896+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"TKC Corporation","vendor",{"name":21,"type":22},"Arara","product",{"name":24,"type":19},"Sega",{"name":26,"type":19},"Japan Airlines",{"name":28,"type":19},"Sony Network Communications",{"name":30,"type":19},"Capcom","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":31,"icon":33,"name":34,"slug":35},null,"Breaches","breaches",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57],{"type":54,"value":55,"context":56},"malware","Claude","AI-tool used by cybercriminals to uncover and exploit bugs in attacks on Japanese systems",{"type":54,"value":58,"context":56},"Artex",[18,24,26],{"controls":61,"vendors":144},[62,89,115],{"slug":63,"name":64,"problem":65,"products":66},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[67,73,81],{"vendor_slug":68,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":68,"url":71,"description":72},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"slug":90,"name":91,"problem":92,"products":93},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[94,99,107],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":95,"product_name":96,"url":97,"description":98},"core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"slug":116,"name":117,"problem":118,"products":119},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":155},"third-party-email-service-breach-exposes-77-million-addresses-across-400-organizations","Third-Party Email Service Breach Exposes 77 Million Addresses Across 400 Organizations","The City of Osaka and nearly 400 other organizations suffered a significant data breach because they relied on a shared third-party email distribution service, Arara, operated by TKC Corporation, without adequate oversight of that vendor's security posture. When attackers compromised Arara, they gained a single point of access to data belonging to all customers simultaneously, amplifying the blast radius dramatically. The compromised service was then weaponized to send phishing emails impersonating financial institutions, turning the breach into an active attack vector against end users. This incident illustrates the cascading risk that emerges when organizations outsource critical communication infrastructure without enforcing contractual security standards or conducting regular vendor audits.",[150,151,152,153,154],"NIS2 Article 21(2)(d)","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","NIST SP 800-53 SA-9: External System Services","CIS Control 15: Service Provider Management","NIST CSF 2.0 GV.SC-07: Supply Chain Risk Management",{"NIS2 Article 21(2)(d)":156,"CIS Control 15: Service Provider Management":157,"NIST SP 800-53 SA-9: External System Services":158,"NIST CSF 2.0 GV.SC-07: Supply Chain Risk Management":159,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":160},"This point requires organizations to implement security measures governing their supply chain relationships, which would have mandated vetting TKC Corporation's security controls before entrusting them with over one million email addresses.","CIS Control 15 specifically calls for establishing and maintaining an inventory of service providers and assessing their security practices, directly applicable to the unvetted reliance on TKC Corporation's shared email infrastructure.","SA-9 requires organizations to define and document security requirements for externally provided services and monitor supplier compliance, which would have surfaced inadequate protections at the Arara platform.","This category asks organizations to assess and respond to risks from suppliers and third-party service providers, which would have required evaluating the security of the shared Arara email distribution service before a breach affected all 400 customers simultaneously.","This control requires organizations to define and implement processes to manage information security risks associated with suppliers, which would have included auditing Arara's security posture and enforcing breach notification obligations."]