Osaka: keep the affected population tied to message records
This analysis checks recipient scope without turning it into a count of people. Message history, account records and exceptions must remain distinguishable.
Lire en portugaisBy Pentesty
The confirmed scope concerns addresses and messages
Osaka’s November 13 notice confirms exposure of 1,078,713 email addresses associated with its online administrative system. The scope covers recipients of messages from July 1 through October 31, 2026. TKC classified and reconciled information supplied by the external service.
Pentesty focuses on the question this kind of scope presents to a business: what evidence explains why a record entered the population under review? The answer needs to follow the messages and their conditions. It cannot depend solely on the size of today’s account register or a total received without a definition.
Define the unit before comparing totals
Give message records, addresses and users different names. An address may appear in several sends, and one user may maintain several addresses. Keep those populations distinct when presenting impact. The report should identify the unit being counted and the comparison that has not yet been completed.
We propose a short field dictionary for reconciliation. Define the message identifier, the recipient represented in a restricted form, the relevant date and the record source. Keep that material out of general communications. A reviewer should be able to understand the counting unit without receiving an unnecessary copy of the addresses.
Assemble message history before drawing conclusions from accounts
Ask system owners to explain which record represents each stage of a message. A send request, an attempted send and a delivery confirmation may produce different files. The team should choose evidence that answers the investigation question and state what it demonstrates. This is part of the proposed assessment, not a description of Osaka’s system architecture.
Next, map the available sources and time ranges. Check how each system represents timestamps, address changes and retries. Document the transformation used for comparison. If a file covers only part of the interval, retain that distinction. Filling the missing period with the current account register can hide the very changes that need examination.
Exercise exceptions without using real recipients
Create a synthetic sample containing one address repeated in two sends, a contact change and a message outside the chosen interval. Write the expected classification for each row before running the comparison. Another person should be able to reproduce the result using the same rule and identify which exception remains unresolved.
Include a timestamp on the boundary and a record without sufficient confirmation. The exercise should show how uncertainty is handled, without converting missing records into automatic exclusion. Retain the rule version and aggregate test results. The task is to show that the population can be explained while keeping personal data out of shared evidence.
Connect the result to communication the evidence can support
Give communications staff the population definition, its version and coverage limits. Public wording should use the same unit as the approved reconciliation. A later revision needs to identify which assumption changed and which messages depended on it. Our analysis of Baker Tilly and affected datasets explores this relationship between recipients and evidence.
Plan the verification of incoming requests separately. Knowing an address does not demonstrate authority to change an account or receive investigation details. Our analysis of contact verification and service guidance helps define that separate workflow. Reconciliation should produce a reviewable explanation of the population, rather than a public lookup mechanism for affected individuals.
Frequently asked questions
Does the total establish unique people or accounts?
The notice counts email addresses. It does not establish a total of unique people or accounts.
Should a repeated address be removed from the investigation?
Preserve necessary history and distinguish address counts from message counts. The aggregation rule needs to remain reviewable.
How can the time boundary be tested?
Use synthetic records immediately before, inside and after the interval. Define the expected result and check the observed classification.
Must an individual list be published?
Keep the data in the authorized environment. Communications can explain the population, counting unit and limitations without exposing recipients.
Sources and references
Original Pentesty analysis, published November 13, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.