About 1.08 million email addresses of users of the mailing service used in Osaka's online administrative system leaked after the provider, Arara, suffered unauthorized access, the city said on the 13th, Kyodo News reported.
The city said it had confirmed no leak of names or My Number information — the national identification number assigned to every resident.
Osaka also disclosed the same day that a contractor handling its premium gift voucher program used Arara and was affected by the breach. About 34,000 email addresses of mailing service users and about 15,000 of participating stores leaked, the city said.
Vendor risk
The disclosures place the security of a private contractor at the center of the incident. Osaka's administrative system relies on Arara's mailing service, so the vendor's breach exposed addresses held for city business.