- Hackers entered Arara, an email distribution service, on November 2. The company says 77 million addresses from nearly 400 customers were exposed, including Osaka's more than 1 million.
- Arara says the attackers also used the service to send millions of fake emails posing as credit card companies and financial institutions, as The Record reports.
- Leaders should list every vendor that sends mail in their name and ask how each would tell customers and cut off access after a breach.
Osaka warned its residents to be careful with email that claims to come from the city. Yet the city had not lost control of its own systems. A vendor that sends its mail had been hacked. That gap is the story. Most organisations rely on senders they do not run.
What happened
The Record reports that Osaka said more than 1 million email addresses were exposed. The addresses were linked to an online administrative services platform. TKC Corporation is the contractor that maintains that platform. TKC used an email sending service called Arara, and hackers broke into it.
The city said that people who got an email from the system between July 2026 and October 31 had their address leaked. Osaka has 2.8 million residents. The city told them not to open links or attachments in suspicious messages that claim to come from the city.
Osaka is one customer among many. Arara itself says an attack on November 2 exposed 77 million addresses. They belonged to nearly 400 customers, including TKC and the gaming company Sega. The Record also reports Arara's statement on how the attackers used the service. They sent millions of harmful emails that pretended to come from credit card companies and financial institutions.
How a mailing service becomes a weapon
An email distribution service is a bulk-mail engine. A customer hands over its address list. The vendor does the sending. So the vendor holds two valuable things: many customers' contact lists and the power to send mail in volume.
That explains the two harms here. One is theft of the lists. The other is misuse of the sending system itself.
The Record does not say how the attackers got in. It also does not say whether the fake messages used the real senders' branding. Those gaps matter, and the public record does not fill them.
The lesson here is that the customer's name goes on the mail, but the vendor's controls decide who can send it. A customer cannot fix a weakness it cannot see. If fake mail does reach people, they may still blame the customer.
A wider wave, and a debate about AI
The Record places the breach within months of attacks on Japanese institutions. These include Japan Airlines, Sony Network Communications and Capcom. Mihoko Matsubara, chief cybersecurity strategist at NTT, told Recorded Future News that attacks began to grow in July. They rose sharply through October.
She said October alone accounted for 58% of this year's reported incidents in Japan. She put the personal data stolen so far this year at about 380 million pieces.
On AI, the evidence is mixed. A study from Japan's national computer security incident response team came out about three weeks before the report. The team says it found signs that attackers use AI to look for known flaws before they strike.
Matsubara said recent breaches appear to involve AI tools such as Claude and Artex. She said these tools help criminals find and use software bugs. But she cautioned that AI cannot explain every breach in this wave.
The Record does not say AI was used against Arara. Treat AI here as one pressure on defenders, not a proven cause of this breach.
The government response and its limit
Prime Minister Sanae Takaichi announced emergency measures last week, backed by about $62 million. They include more AI for cyber defence, better information gathering and more help for breach victims. Companies were urged to report attacks to government agencies faster.
Matsubara said the key admission is that cybersecurity “cannot be left entirely to individual organizations.” She also warned that the money must start a longer effort and not serve as a one-time fix.
For executives, the same logic applies inside a company. Security that stops at your own network misses the vendors that speak for you.
Questions to put to your team
Ask which outside services send email, text messages or notices in your name. Ask who owns each relationship. Ask what the contract says about how fast a vendor must tell you of a breach.
Ask whether your team could tell customers within hours which addresses were exposed. Ask how a vendor's access is limited, and how fast you could cut it off.
Finally, decide now how you would warn customers about fake mail in your name. Osaka had to do that in public, with 2.8 million residents listening.
If a vendor's breach puts mail in your name into customers' inboxes, it becomes their problem and yours.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
