Arcadia: unauthorized access to the SpeeCAN RAIDEN alert service
Arcadia's detailed October 19 timeline places the attack from 06:26 on October 11 and detection of abnormal database load at 23:40 that day, differing from the initial 16:30 account. At SpeeCAN RAIDEN, up to about 3,136,000 email addresses, 105,000 phone numbers and 15,000 fax numbers may have leaked. Malicious code sent 1,423,428 messages early on October 13; some services were stopped and resumed October 15. Traces of access also affected NET119 and 119RAIDEN, potentially exposing fields including names, birth dates, genders and addresses. These figures are not a deduplicated count of affected people. At a press conference on October 23 the president said the attacks were still continuing. According to MBS, at least about 560,000 email addresses may have leaked across 393 bodies, including 15 prefectures and 366 municipalities, and 20 prefectural police forces. In Tochigi, Kanuma City said data of about 7,800 disaster mail subscribers may have leaked, and its fire department named email addresses of 106 users of 119 Raiden and Net119. Nasukarasuyama City, Ichikai Town and Shioya Town also said their subscribers' data may have leaked. Police forces that use the service for staff safety checks are affected too: all about 3,900 staff of Tochigi Prefectural Police, and about 16,000 in Kanagawa, 15,000 in Aichi, 13,000 in Saitama, 11,000 in Fukuoka and 2,200 in Kagoshima. In Hiroshima Prefecture, Fukuyama City said about 63,000 registrations for its disaster mail and its fire department union's fire alerts may have leaked, Hatsukaichi about 11,000 and Takehara about 3,500, and Hiroshima City said about 10,000 staff records in its staff call-up system were affected. Hiroshima Prefectural Police named the names, departments and private email addresses of all about 5,700 staff. Saitama City named 34,783 email addresses for its disaster radio mail, 195 of them linked to staff names, and the names and numbers of 73 users of its phone and fax alert service. Okazaki City said about 37,000 disaster mail registrations, about 30,000 parents of municipal school pupils and about 2,400 fire service call-up entries may be affected.
Disclosed
2026-10-13
Organizations involved
28
Leaked or at risk
3.1M
3,136,000
Downtime
Unknown
Timeline
- Started, Detected 2026-10-11
- Disclosed 2026-10-13
- 2 days
Attack or cause
- Method
- [Web app exploit]
- Impact
- [Data leak][Service outage]
- Entry point
- Web app
Data exposed or at risk
Supply chain
[Breached]
[Breached]
- Takehara City
- Aichi Prefectural Police
- Chiba Prefectural Government
- Fukuoka Prefectural Police
- Hiroshima City
- Hiroshima Prefectural Police
- Hyogo Prefectural Police
- Kagoshima Prefectural Police
- Kanagawa Prefectural Police
- Nagoya City
- Oita Prefectural Government
- Okayama Prefectural Police
- Saitama City
- Saitama Prefectural Police
- Tochigi Prefectural Police
- Chiba City
- Fukuyama City
- Hadano City
- Hatsukaichi City
- Oita City
- Okazaki City
- Yokosuka City
- Ichikai Town
- Kanuma City
- Minamiboso City
- Nasukarasuyama City
- Shioya Town
- Organizations listed on this site
- 28
Services hit
Organizations involved
[Breached][Critical]Osaka, MinohInformation and communications
Arcadia, Inc.[Through a supplier][Critical]Hiroshima, TakeharaMunicipality3,500 leaked
Takehara CityAbout 3,500 disaster mail registrations; mail was paused and resumed on October 15.
[Through a supplier][Major]Aichi, Nagoya, NakaPolice15,000 leaked
Aichi Prefectural PoliceNames, departments and email addresses of about 15,000 staff in its safety check service.
[Through a supplier][Major]Chiba, Chiba, ChuoPrefecture4,266 leaked
Chiba Prefectural GovernmentAbout 3,000 staff in its disaster call-up system (department, name, personal email and phone), plus about 1,000 water works staff, about 40 retired staff, about 220 members of related bodies and 6 contractor employees in the water works system; no residents' data.
[Through a supplier][Major]Fukuoka, Fukuoka, HakataPolice11,000 leaked
Fukuoka Prefectural PoliceNames, email addresses and departments of about 11,000 staff in its safety check system.
[Through a supplier][Major]Hiroshima, HiroshimaMunicipality10,000 leaked
Hiroshima CityNames, email addresses and more of about 10,000 staff in its staff call-up system; its disaster mail for residents was not affected.
[Through a supplier][Major]Hiroshima, Hiroshima, NakaPolice5,700 leaked
Hiroshima Prefectural PoliceNames, departments and private email addresses of all about 5,700 staff in its safety check system.
[Through a supplier][Major]Hyogo, Kobe, ChuoPolice13,000 leaked
Hyogo Prefectural PoliceEmail addresses, partial names and department codes of about 13,000 people in its safety check system.
[Through a supplier][Major]Kagoshima, KagoshimaPolice2,200 leaked
Kagoshima Prefectural PoliceNames, departments and email addresses of about 2,200 staff.
[Through a supplier][Major]Kanagawa, Yokohama, NakaPolice16,000 leaked
Kanagawa Prefectural PoliceNames, email addresses and more of about 16,000 staff in its safety check system.
Sources
- [1][Official]弊社サービスへの不正アクセスに伴う一連の対応についてArcadia · 2026-10-13
- [2][Official]不正アクセスの経過と当社の対処についてArcadia · 2026-10-19
- [3][News]「SpeeCAN RAIDEN」に不正アクセス発生のアルカディアが続報、情報漏えいは引き続き調査中INTERNET Watch · 2026-10-16
- [4][Official]不正アクセスの疑いに伴う防災メール等配信システムの新規登録等停止についてOita Prefectural Government · 2026-10-13
- [5][News]大分県の防災メールアドレス、漏洩の可能性 登録数は2万7千件The Asahi Shimbun · 2026-10-13
- [6][Official]職員参集システム等における職員等情報の漏えいの可能性についてChiba Prefectural Government · 2026-10-14
- [7][Official]不正アクセスにより個人情報が漏えいした可能性のある事案の発生についてChiba City · 2026-10-14
- [8][Official]配信休止中 緊急情報メールHadano City · 2026-10-15
- [9][Official]不正アクセスに伴う安全安心メールサービス緊急停止のお知らせ(第2報)Minamiboso City · 2026-10-13
- [10][News]防災メールに不正アクセス 複数自治体、情報漏えいの可能性Jiji Press · 2026-10-13