Osaka breach exposes 1M emails as Japan faces wave of cascading cyberattacks

The city of Osaka disclosed a significant data breach affecting over 1 million residents, stemming from a compromise of third-party contractor TKC Corporation's Arara email distribution service. Anyone who received city emails between July 2026 and October 31 had their email address exposed, with officials warning residents to be vigilant against phishing campaigns impersonating municipal communications.

The breach is part of a broader attack on Arara that exposed 77 million email addresses across nearly 400 customers, including major corporations like Sega. Japan has been experiencing a sustained wave of cyberattacks targeting critical infrastructure, prompting Prime Minister Sanae Takaichi to announce emergency measures and allocate $62 million toward AI-enhanced cyber defense and faster incident reporting. The incident underscores the systemic risks posed by supply chain vulnerabilities in government and corporate IT ecosystems.