Up to 2.23 Million Emails Leaked in Japan Vendor Breach Tied to Yokohama and Kawasaki

Photo: Suicasmo, Wikimedia Commons, CC BY-SA 4.0 (file photo, December 2022). Yokohama City Hall main building at night.

Up to 2,230,812 email addresses belonging to users of systems run by TKC Corp., a vendor that runs online application portals for Japanese cities, were leaked after a hacker broke into an email delivery service it used, the company said on Wednesday, Nov. 4. Yokohama, whose online system has about 820,000 accounts, and Kawasaki, with about 320,000, have both warned that their residents’ data may be among them.

TKC, based in Utsunomiya, north of Tokyo, said the breach hit “Arara Message,” an email service run by Tokyo-based Arara Inc. that TKC used to send messages to users. Arara’s investigation found that only email addresses were taken, according to TKC’s third update on the incident. Email text, My Number national ID numbers and applications filed with cities were not leaked, TKC said. It is still working out whose addresses were taken.

What Yokohama has said

Yokohama’s online application and notification system lets residents and businesses file about 2,500 kinds of forms with the city around the clock, according to a city statement issued on Nov. 3. It had about 820,000 individual and business accounts as of Nov. 2.

The city’s timeline shows how the problem surfaced over a weekend:

• Oct. 31, about 5:31 p.m.: TKC told the city it would stop the email service for emergency maintenance as a security precaution. The service went down at about 5:40 p.m.
• Nov. 1, about 12:41 p.m.: TKC reported that Arara had detected unauthorized access by a third party.
• Nov. 2, about 9 a.m.: Arara posted a notice about the leak and the service outage on its website.
• Nov. 2, about 6 p.m.: TKC told the city that Yokohama’s system was among those that could be affected.

All times are Japan time, 14 hours ahead of ET. The city said user email addresses and user names may have leaked. It said the number of affected records, and whether Yokohama users’ data was taken at all, were still being checked by TKC and Arara.

By the numbers: who uses the affected systems

Kawasaki, Yokohama’s neighbor in Kanagawa Prefecture, also contracts TKC for its online application system, the Asahi Shimbun reported. Both cities said by Nov. 3 that their users’ personal data may have leaked. TKC used Arara’s service to send identity-check emails to users of both systems, the Asahi said.

Osaka’s city government said its administrative online system, which is also provided by TKC and uses Arara, may have exposed users’ email addresses and names, according to a city release. It said the break-in affected the outside email service only. No intrusion into the city’s own system or the provider’s data center had been found. On Nov. 4, Osaka narrowed that, saying the only data that may have leaked was email addresses, the Sankei Shimbun reported.

The 2.23 million figure covers users of all of TKC’s systems. It is not a count of Yokohama, Kawasaki or Osaka residents, and the cities’ account totals should not be added to it.

What users can and cannot do

While the email service is down, Yokohama users cannot register, change their email address or reset their passwords, the city said. Anyone whose login requires an emailed two-factor code cannot sign in. Forms that do not require logging in are not affected. TKC said it is working to send messages through a different email platform.

Both cities warned residents not to open links or attachments in unexpected emails, and not to type in IDs, passwords, PINs or credit card numbers. Osaka said Arara’s service had been misused to send emails pretending to come from credit card companies. It told anyone who receives one to delete it without clicking the link.

Why it matters

The breach shows how one outside vendor can affect several governments at once. None of the cities has said its own servers were broken into. The risk came from a contractor’s contractor, the company that sends the emails. A list of addresses linked to city services is useful for phishing, the kind of fake card-company messages Osaka described.

U.S. cities and school systems use similar outside services for notifications and logins. TBR reported this week on a different vendor breach that exposed records at three Seoul international schools using PowerSchool. For U.S. government alerts on cyberattacks and other threats, see TBR’s page on security threat warnings. More regional coverage is in TBR’s Asia-Pacific news section.

Sources

• TKC Corp.: Information leak due to unauthorized access at email delivery contractor (third report, Nov. 4, 2026, Japanese)
• City of Yokohama: Possible leak of personal information from the email service used by the online application system (Nov. 3, 2026, PDF, Japanese)
• Asahi Shimbun: Possible data leak in Yokohama and Kawasaki online application systems (Japanese)
• City of Osaka: Possible leak from email delivery service used by the administrative online system (Japanese)
• Sankei Shimbun: Osaka says only email addresses may have leaked (Japanese)

Additional sources

• City of Yokohama: press release page
• Nikkei: Yokohama online application system (Japanese)
• Nikkei: Osaka Prefecture and Osaka City (Japanese)