Personal data on about 125,000 police officers and civilian employees in Japan may have been exposed in a breach at Arcadia Inc., an Osaka-based company that provides disaster information services. National Police Agency (NPA) officials disclosed the figure on October 21, 2026, according to The Straits Times and Kyodo News. The police data sat in an outside staff safety and emergency contact system, not in police networks, and the NPA said no investigative information leaked. The police exposure is one part of a larger compromise. Arcadia's SpeeCAN RAIDEN platform sends disaster alerts for hundreds of municipalities, and the attackers also used Arcadia's infrastructure to send more than 1.4 million phishing emails.
No PRIMARY-tier source was available for this brief. The NPA figures come through outlet and wire reporting. Arcadia's technical account comes from its October 19 report "不正アクセスの経過と当社の対処について" ("The progress of the unauthorized access and our response"), as summarised by secondary sources.
What Happened
Arcadia says it found suspicious activity on the night of October 11, 2026, when its internal monitoring flagged unusual database load. Its October 19 report, as summarised by Tetoran, Hakky Handbook and Japan Cyber Watch, gives this sequence:
- October 11: Attackers exploit a directory path traversal flaw on a public media server, read internal source files, take a secret key, and get in. Arcadia detects the intrusion that night. Hakky Handbook puts the gap at about 17 hours from the start of the attack to detection.
- October 12: Arcadia blocks the entry point, changes database passwords, and files a preliminary report with the Personal Information Protection Commission. The password change breaks some downstream services, including one town's fire information feed and its outbound phone calls. Arcadia also finds that a plugin was added to its WordPress installation without authorisation.
- October 13: A spike in outbound mail reveals a backdoor. The malicious sending is stopped that morning. Arcadia takes the compromised systems "raiden3" and "s2" offline, consults its local police and JPCERT/CC, and blocks the attacking IP addresses. Signs of access are also found in the NET119 database.
- October 14: More signs of access turn up in the legacy 119RAIDEN/NET119 databases and an internal accounting subsystem. Several altered records are found in the raiden3 database.
- October 15: Arcadia fixes the tampered data by hand, confirms its source code was not modified, and restores all services.
- October 16: The NET119 exposure is narrowed to data linked to 9,020 email addresses.
Police forces came into the picture because many of them used an Arcadia system to check on staff safety and availability during disasters, according to The Asahi Shimbun. Individual forces began disclosing their exposure from about October 15. The NPA released the national total on October 21.
Accounts differ on how many forces are affected. The Straits Times (OUTLET) says the roughly 125,000 records cover 22 prefectural forces. Kyodo's English report also says 22 forces in its lead, but says "20 prefectural police forces" in the sentence giving the 125,000 figure. This could be a typo, or it could mean the staff records cover 20 forces and the other two are affected through resident data only. The sources do not settle it.
No threat actor has been named, and no group has publicly claimed the attack. The Straits Times and Kyodo place the incident within a wider wave of Japanese and South Korean breaches described as AI-aided. However, the only incident in their reporting explicitly linked to AI is a separate one at IwaiCosmo Securities. None of the sources attributes the Arcadia intrusion to AI-assisted tooling.
What Was Taken
Police personnel data. According to the NPA via The Straits Times and Kyodo, about 125,000 records may be exposed, including names and email addresses of officers and staff. Lower counts also circulate, and they measure different things:
- Security Measures Lab (OTHER) added up figures from individual news reports and confirmed 13 forces with named headcounts, totalling about 93,800 people. It says this is a sum of registrant counts, not a confirmed number of exfiltrated records, and it leaves out forces whose numbers were not reported.
- Force-level figures reported by The Asahi Shimbun and others include:
- Kanagawa: about 16,000, out of nearly 17,000 total staff
- Aichi: about 15,000
- Saitama: about 13,000
- Hyogo: about 13,000
- Fukuoka: about 11,000
- Hiroshima: about 5,700
- Okayama: about 4,000
- Tochigi: about 3,900, effectively its whole workforce
- Gunma: about 3,700
- Kagawa: about 2,400
- Kagoshima: about 2,200
- Fukui: about 2,000
- On Fukui, Security Measures Lab cites reports that Arcadia said the data sat on a different server from the breached one, so a leak there is unlikely.
The fields differ by force. They include names, department affiliations, and work or personal email addresses. Tochigi police told The Asahi Shimbun that their records also include job titles and mobile phone numbers.
Resident data held by police. About 16,000 email addresses of residents signed up for crime and security alerts from the Kyoto, Fukuoka, Shimane and Yamaguchi police were exposed, according to The Straits Times and Kyodo.
Wider Arcadia exposure (OTHER-tier, attributed). Japan Cyber Watch reports that across SpeeCAN RAIDEN, up to about 3.14 million email addresses, 105,000 phone numbers, 15,000 fax numbers and the text of past alerts may have been exposed. Arcadia itself calls these figures estimates. For NET119, a text-based emergency service for people who are deaf or have speech disabilities, the first estimate was about 13,000 users' names, addresses and dates of birth. Arcadia later narrowed this to data tied to 9,020 email addresses and said sensitive data such as health information did not leak, although one fire department had earlier warned that users' medical conditions might be involved.
Why It Matters
- Third-party concentration risk. One small vendor held contact data for nearly half of Japan's 47 prefectural police forces and, according to Nikkei via Japan Cyber Watch, served 875 municipalities. Police networks were not breached, but the attackers still obtained a large set of police identities.
- Targeting value. Lists linking police officers' names to their units and personal email addresses or mobile numbers are useful for spear-phishing, social engineering, doxxing, and pressure on individual officers. Losing personal contact details matters more than losing work addresses, because personal accounts sit outside agency email defences.
- Abuse of a trusted sender. The backdoor sent 1,423,428 emails, many of them fake credit card "balance confirmation" messages, through infrastructure normally used for disaster alerts. Mail from a trusted public-safety sender can get past both filters and user suspicion.
- Damage to public-safety services. Dozens of local governments suspended their alert emails, and Okayama lost its ability to make dam-release warning calls, according to Japan Cyber Watch. Arcadia's own containment work, the database password changes, also broke dependent services such as fire department feeds and automated responses.
The Attack Technique
Based on Arcadia's October 19 report as summarised by three secondary sources, the attack ran as follows:
- Initial access: The attackers exploited a directory path traversal flaw on a media server that serves public attachments. This let them reach internal paths and download source files. Hakky Handbook says these included a front-end login script and a config.ini file.
- Credential harvesting: The configuration file contained a secret key used for login between Arcadia's own services, stored in plain text.
- Account takeover: Using the stolen key, the attackers brute-forced account IDs, logged in, and pulled internal data.
- Persistence: The attackers installed a backdoor and added a plugin to Arcadia's WordPress installation without authorisation. Both survived the closure of the original entry point on October 12.
- Abuse and tampering: The backdoor was used to send phishing email on a large scale, and records in the raiden3 database were altered.
Arcadia says it has since fixed the traversal flaw, run LLM-assisted vulnerability scans and code review in-house, given each service its own database password, and plans to add two-factor authentication, outside penetration testing and a possible SOC. A specialist third-party firm will carry out a fuller investigation.
What Organizations Should Do
- Inventory vendors that hold staff contact data. Safety-confirmation, emergency-notification and HR contact platforms often hold personal phone numbers and email addresses outside your security perimeter. Find out where that data lives, which fields you actually need, and whether personal contact details can be removed.
- Warn affected staff about targeted phishing. Officers and employees should expect convincing lures that use their name, unit and personal email. Watch especially for messages that impersonate disaster alerts or emergency recall notices.
- Get secrets out of config files. Move service-to-service keys and database credentials into a secrets manager, rotate them regularly, and limit each one to a single service. A single shared key should not be able to unlock internal logins.
- Test for path traversal on file-serving endpoints. Media and attachment servers are commonly overlooked. Make sure they cannot reach source directories or config files, and block requests for .ini, .env and source files at the edge.
- Hunt for persistence before declaring an incident over. Check for new CMS plugins, web shells, cron changes and unusual outbound mail volume. Arcadia's backdoor sent 1.4 million emails after the first entry point had already been closed.
- Alert on authentication brute-forcing and outbound mail spikes. Rate-limit login endpoints, including internal and service-to-service ones. Treat sudden jumps in database load or SMTP volume as security events, not only performance problems.
Sources: Data breach potentially exposes information of 125,000 police offic... | Japan police data breach exposes 125000 records | data breaches reported by Japan prefectural police forces, ... | アルカディア不正アクセスに学ぶ、設定ファイルの秘密の鍵が抜かれたときに今日確かめる6つのこと てとらのITさんぽ | Japan Disaster Alert Email Breach: Up to 3.1 Million Addresses Expo... | Arcadia Reports 1.42 Million Fraudulent Emails via Backdoor Hakky... | アルカディア 防災情報配信サービスへの不正アクセス、13県警の警察官・職員約9万3,800人分に情報漏えいの可能性―個別報道を独自集計... | Thousands of police personnel records exposed in app breach The As...