Osaka City said on the 3rd that personal information used by its online administrative system may have leaked through an email distribution service the system relies on.
The service, Arara Message, is run by Arara, a company based in Tokyo. It was hit by unauthorized access, and names and email addresses may have been exposed as a result, the city said. Credit card numbers and My Number identification numbers were not included, according to the city.
The city registers users and handles email address changes for the online administrative system through an outside system provider. Several systems run by that provider used Arara Message.
Up to 2,238,012 email addresses handled by the provider may have been affected, and the city's information is among them, the city said.
The email service has been unavailable since October 31 because of emergency maintenance. The city learned of the possible leak from the provider on the night of November 2.
No unauthorized access to the administrative system itself or to the provider has been confirmed so far, according to the city. Osaka is investigating whether personal information actually leaked.