Arcadia Inc., based in Minoh, Osaka, has confirmed that an outside party gained unauthorized access to SpeeCAN RAIDEN. The cloud service sends disaster, weather and safety alerts by email, voice and fax for Japanese local governments. In its own notice, Arcadia estimates that up to about 3,136,000 email addresses, 105,000 phone numbers and 15,000 fax numbers may have been exposed. It calls these figures estimates that are still under investigation. Reports of how many municipalities use the service differ. Arcadia told INTERNET Watch it had 875 deployments at the end of September, and Kyodo and Japan Cyber Watch (citing Nikkei) give the same number. INTERNET Watch, citing the Digital Agency's disaster-DX catalogue, and Particle put the figure at "700+" or "roughly 700". The intrusion is confirmed. Data theft is not: Chiba City says no actual leak or misuse has been confirmed so far. Even so, residents in several cities are already receiving phishing emails.
What Happened
Arcadia and the municipal notices from Chiba and Chuo Ward give the same timeline:
- 11 October, 16:30: Arcadia detected suspicious behaviour that pointed to unauthorized access on SpeeCAN RAIDEN.
- 12 October, around 03:00: Arcadia blocked the intrusion path as an emergency measure and began working out the scope.
- 13 October: Arcadia published its disclosure. It said it had found the intrusion path, shut down the affected services, and blocked the attacking IP address. Chiba City says it learned of the incident at about 11:30 that day.
- 14 October: Arcadia expanded the incident. Its fire-service products NET119 and 119RAIDEN also showed signs of unauthorized access. Arcadia then widened the review to every service it runs, checking for planted "unauthorized programs".
Kyodo reports that by 17:00 on 14 October, Japan's Ministry of Internal Affairs and Communications had received reports of suspended services or possible data leaks from 110 local governments. The ministry has asked Arcadia to report on the damage. Arcadia told Kyodo it does not yet know when recovery will be complete.
Municipalities have responded in different ways. Yokote (Akita), Kagawa Prefecture and Okayama have suspended alert distribution. Japan Cyber Watch reports that Okayama also lost the ability to make phone calls warning of dam water releases. Chiba City and Tokyo's Chuo Ward are keeping their services running. Both say the intrusion path is closed and the alerts are too important to switch off. Japan's mobile emergency alerts (緊急速報メール), which reach phones without any sign-up, run on a separate system and are not affected.
What Was Taken
Arcadia lists the potentially exposed SpeeCAN RAIDEN data as: - contact names, email addresses, and phone and fax numbers - staff contact details and contract information - the text of past alerts stored in message history
Arcadia says it does not handle payment card data.
Figures by service, from Arcadia's notice:
| Service | Potentially exposed data | Maximum estimated count |
|---|---|---|
| SpeeCAN RAIDEN | Names, emails, phone/fax, contract data, message history | ~3,136,000 emails, ~105,000 phones, ~15,000 fax |
| NET119 (text-based emergency calls to the fire service for deaf and speech-impaired users) | Name, birth date, sex, address, phone, email, fax, data entered when registering for other services | ~13,000 users |
| 119RAIDEN | Contact names, emails, phone/fax, message history | ~97,000 emails, ~17,000 phones, ~400 fax |
Arcadia says NET119's video-relay function is not affected. It later removed two 119RAIDEN hostnames (fs119.speecan.jp and 119r.speecan.jp) from the affected list. Japan Cyber Watch reports that one fire department warned its NET119 users' chronic illnesses and medications may be included. That claim comes from a single source and has not been confirmed elsewhere.
Figures from municipalities show how the exposure breaks down locally: - Chiba City: 61,319 residents on the safety email list (email plus neighbourhood), 10,606 staff (name, phone, email), 2,012 phone/fax alert registrants, and 1,810 water-level alert subscribers. - Chuo Ward, Tokyo: 7,315 safety email subscribers and 2,690 staff on the staff-callout system (name, email, staff ID, department). - Saitama: 34,783 emails and 73 voice-service records (INTERNET Watch). - Yokosuka: accounts differ. INTERNET Watch reports 47,065 emails plus 996 fax-service registrants. Particle reports about 58,920 records in total. - Nagasaki and Sasebo: about 28,432 and 11,800 records respectively (Particle). - Shimane Prefectural Police: up to about 16,000 emails registered on an Arcadia-run crime-prevention alert system (Kyodo). Kyodo also reports a possible leak at Hiroshima Prefectural Police.
AliasFleet, which is tallying the municipal disclosures, says a second wave added about 343,000 registrations from 17 more places, and that Arcadia has not yet published a consolidated total. Every source stresses that these are records that may have been exposed. None confirms that data was actually copied out.
Why It Matters
This is a supply-chain breach of public-safety communications. One vendor compromise has reached hundreds of local governments, their staff callout lists, police alert systems, and an accessibility lifeline for people who cannot make voice emergency calls.
Phishing has followed quickly. Japan Cyber Watch reports that Saitama and Yokosuka first learned of the breach when residents reported suspicious emails. AliasFleet, citing TV Asahi, says Yokosuka confirmed that a fake card-company email had reached addresses that may have leaked. Shizuoka says it has seen a fake credit card email that used the alert service's own sender domain. SBS reports that Kikugawa residents received forged billing mail sent from that domain. If attackers can send from a domain residents trust for safety alerts, that is far more serious than a list of leaked addresses. It means people can no longer assume a message from that domain is genuine, either for scams now or for fake alerts during a real disaster.
The incident also cuts into emergency capacity. Municipalities have had to choose between suspending a key warning channel and running it on a platform whose full compromise is still being scoped. Staff callout lists that were exposed could be used to target the officials who coordinate disaster response.
The Attack Technique
Arcadia has not disclosed the initial access method, any vulnerability, or the threat actor. No group has claimed the attack in the available sources. What is known:
- Arcadia names raiden3.ktaiwork.jp (SpeeCAN RAIDEN) and s2.ktaiwork.jp (Raiden School) as the intrusion path. Both were taken offline on 13 October.
- INTERNET Watch lists six affected server hostnames: raiden.ktaiwork.jp, raiden2.ktaiwork.jp, raiden3.ktaiwork.jp, raiden2.speecan.jp, s.ktaiwork.jp and s2.ktaiwork.jp. Arcadia told the outlet that the entire SpeeCAN RAIDEN service is affected.
- NET119 (net119.speecan.jp, net119fd.speecan.jp) and 119RAIDEN (fs119.ktaiwork.jp) also show signs of access.
- Arcadia's statements that it is checking servers for "unauthorized programs" suggest the attackers planted code such as web shells or other implants on the servers, although Arcadia has not said what it found. Arcadia has also blocked a source IP.
- Shizuoka and Kikugawa report spoofed or abused mail from the service's sender domain. This raises the question of whether the attackers also gained access to the sending infrastructure, beyond the subscriber data. Arcadia has not addressed this.
What Organizations Should Do
- Municipalities and agencies using Arcadia products: get your exact per-service exposure counts from Arcadia in writing. Ask whether your sending configuration, sender domain or API credentials were reachable, and rotate every administrator credential and integration secret now.
- Lock down sender authentication: where you control the alert domain or a subdomain, enforce SPF, DKIM and a DMARC policy of
p=reject. Watch DMARC aggregate reports for unauthorised senders, and ask Arcadia to do the same for its shared sending domains. - Warn residents and staff directly: tell them through channels you control (website, social media, public-address systems) that genuine alerts never ask for card, bank or password details. Use the template Arcadia supplied on 14 October as a minimum.
- Protect sensitive cohorts: fire departments using NET119 should contact affected users individually through accessible channels. Those users may be targeted with scams that impersonate emergency services, and email or text may be their only way to receive warnings.
- Keep a backup alert path: document and test at least two independent alert paths, for example J-Alert or mobile emergency alerts, disaster radio and social media, so that suspending one vendor does not cut off dam-release or evacuation warnings.
- Review vendor risk across shared SaaS: list every public-safety system that holds resident data with a third party. Require incident-notification deadlines, data-retention limits (in particular, purge message history that stores personal data) and evidence of security monitoring.
Sources: Japan Disaster Alert Email Breach: Up to 3.1 Million Addresses Expo... | SpeeCAN RAIDENへの不正アクセスによる個人情報漏洩の可能性について | Disaster info service halted in parts of Japan over data breach fears | Arcadia Breach Second Wave Adds About 343,000 Records | Particle: Unauthorized Access to Arcadia Alert System May Have Expo... | 中央区ホームページ／「ちゅうおう安全・安心メール」等の配信システムにおける 不正アクセスに関するお知らせ【2026年10月14日プレス... | 自治体の防災情報配信などに使われる「SpeeCAN RAIDEN」、不正アクセスで個人情報漏えいの可能性 - INTERNET Watch | 詳細情報