THE CRUNCH

The city of Osaka has warned that a breach at a third-party technology provider exposed more than 1 million email addresses tied to its online administrative services platform. Hackers accessed the Arara email distribution service used by TKC Corporation, the contractor maintaining the platform, and anyone who received an email from the city's system between July 2026 and October 31 had their address leaked, according to the city. Osaka's 2.8 million residents are being urged to watch for suspicious emails purporting to come from the city and not to open any URLs or attachments.

The disclosure came days after Osaka Prefecture, the surrounding regional government, announced its own breach involving participants in a food support programme. Both incidents came amid the cascading Arara attack, which the company says exposed 77 million email addresses from nearly 400 customers on November 2, including TKC and gaming giant Sega, and which hackers used to send millions of malicious emails posing as credit card companies and financial institutions.

The breach lands amid a months-long wave of attacks on Japanese companies and institutions, from Japan Airlines to Sony Network Communications and Capcom. Last week Prime Minister Sanae Takaichi announced a package of emergency measures, backed by about $62 million, covering AI-assisted cyber defence, better information gathering, offensive cyber capabilities and support for breach victims, alongside calls for companies to report attacks faster.

Mihoko Matsubara, chief cybersecurity strategist at NTT, told Recorded Future News that attacks on Japanese systems began growing in July and surged through October, with 58% of this year's reported incidents occurring in that month alone, and roughly 380 million pieces of personal data stolen so far this year. She said some of the recent breaches appear to involve AI tools such as Claude and Artex that help criminals find and exploit bugs, though not every breach in the wave can be attributed to AI, and warned that much stolen Japanese data is already being traded on the dark web.