City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents - The Record from Recorded Future News

According to a government statement, the breach exposed email addresses of anyone who received communications from the city's administrative platform between July 2026 and October 31. The city's 2.8 million residents have been warned to be vigilant against suspicious emails claiming to be from municipal authorities and to avoid clicking any suspicious links or attachments.

Widespread Impact

The attack on Arara has had cascading effects across Japan, with the company reporting that the November 2 cyberattack compromised 77 million email addresses from nearly 400 customers. These include TKC Corporation, gaming giant Sega, and numerous other businesses and government entities.

Arara confirmed that hackers exploited their email distribution service to send millions of malicious emails impersonating credit card companies and financial institutions. The breach follows another incident in Osaka Prefecture involving the personal information of participants in a food support program.

National Response

Japan has been grappling with a surge in cyberattacks affecting critical companies and institutions, including Japan Airlines, Sony Network Communications, and Capcom. Last week, Prime Minister Sanae Takaichi announced emergency cybersecurity measures, allocating $62 million for AI-driven defense, improved intelligence gathering, and enhanced support for breach victims.

Growing Threat

Japan's national Computer Security Incident Response Team has found evidence that attackers are using AI to scan for vulnerabilities before launching attacks. NTT's Mihoko Matsubara reported that cyberattacks began increasing in July and surged in October, with 58% of all reported incidents occurring that month.

Approximately 380 million pieces of personal data have been stolen this year, with large amounts already being traded on the dark web. Some data has been used for fraudulent securities transactions, with concerns that well-resourced actors could compile comprehensive databases of Japanese citizens' activities and preferences.

Matsubara noted that while some breaches involve AI tools like Claude and Artex, not all can be attributed to artificial intelligence. The recent surge follows new cybersecurity legislation that enables more robust government responses to significant attacks.