Arara email vendor breach exposes up to 77M addresses, hits Osaka

A breach at Arara, a Japanese email-delivery provider, exposed up to 77 million email addresses across roughly 400 customers, and attackers abused the service to blast phishing messages impersonating banks and card issuers. The fallout is cascading into local government: TKC Corporation, which runs online administrative portals for Japanese municipalities, confirmed up to 2,230,812 customer addresses in the breach, and the City of Osaka is among the cities notifying residents. Only email addresses were taken, per the investigations so far.

What happened

The intrusion hit Arara's email-distribution environment around November 2, per reporting at Recorded Future News and eSecurity Planet. Arara says up to 77 million addresses were taken or may have been — a figure it stresses is still being verified and does not equal a number of people. The service was then used to send large volumes of phishing email spoofing credit-card companies and financial institutions.

Arara serves downstream platforms, including TKC, which maintains municipal online-service portals, and consumer brands such as Sega. TKC says its investigation confirmed up to 2,230,812 email addresses exposed and that only addresses — not message contents, My Number card data, or application details — were taken.

Who's affected

• City of Osaka: notified residents that names and email addresses of its administrative-portal users may have leaked via Arara. The city says it has no evidence its own systems or TKC's data center were accessed directly, and its exact count was still being confirmed. (Recorded Future framed the Osaka exposure as around 1 million; treat the precise figure as provisional.)
• Other municipalities reporting exposure through the same Arara service include Sakai, Koriyama, Himeji, Utsunomiya, Yokohama, and Sendai.

What to do today

1. If you received email appearing to come from these services, treat card- or bank-themed messages as phishing. Do not open links or attachments; navigate to the institution directly.
2. If your org uses Arara or TKC-run portals, assume subscriber addresses are exposed and brief users to expect targeted phishing.
3. Tighten inbound filtering for spoofed financial-sector lures referencing Japanese municipal services.
4. Watch for secondary fraud — an address-only breach still fuels convincing, well-targeted phishing against a known-valid list.

Context

This is a vendor breach with a municipal blast radius: one compromised email-delivery platform exposes addresses from hundreds of its customers at once, the same multiplier we have seen in other provider-level incidents. It lands amid a sustained wave of attacks on Japanese organizations — Japan Airlines, Sony Network Communications, and Capcom among them. Prime Minister Sanae Takaichi convened a cybersecurity cabinet meeting and announced roughly $62 million in emergency funds; NTT's Mihoko Matsubara said October accounted for 58% of this year's reported incidents, with about 380 million personal records stolen in Japan so far this year. The exposed data is "just" email addresses — but as a pre-vetted target list feeding an active phishing operation, that is the useful half.