TKC data breach

TKC announced a data breach on Nov 2, 2026 affecting about 2.2 million email addresses, exposing email addresses. It happened through a vendor (Arara (email delivery service)). No settlement or compensation has been announced.

What happened

TKC, a Japanese provider of software for accounting firms and local governments, said on November 2, 2026 that up to 2,230,812 email addresses of people using TKC systems leaked after an outsider broke into "Arara Message", the Arara service TKC used to send emails. The addresses include those that received emails from municipal online application and My Number card pickup booking systems run on TKC software, as well as accounting firm systems. Only email addresses were taken; email contents, My Number data and application details were not. TKC says its own systems and data centers were not breached, and it narrowed down the affected systems in a sixth notice on November 9.

What should I do?

1. Be wary of emails claiming to come from your city office, TKC, an accounting firm or Arara, and don't open their links.
2. Don't enter personal details or PINs on a page reached from an email about My Number card pickup or online applications; check on your local government's official site.
3. Consider filtering or changing the email address you registered if scam emails increase.

More data breaches in Japan →

Check the other services you use →