Key takeaways
- Arcadia (アルカディア), an Osaka-based company whose SpeeCAN RAIDEN service sends disaster alert emails, voice calls and faxes for Japanese local governments, says attackers got into its systems. It found suspicious activity on October 11, 2026.
- Up to about 3.14 million email addresses, 105,000 phone numbers and 15,000 fax numbers may have been exposed, along with the text of past alerts. Arcadia calls these estimates.
- SpeeCAN RAIDEN was used by 875 municipalities at the end of September, according to Nikkei. Dozens of cities, towns and prefectures have suspended their alert emails, including Okayama, which also cannot make phone calls warning of dam water releases.
- On October 14, Arcadia said NET119, a service that lets people who are deaf or have speech disabilities call the fire service by text, was also affected. About 13,000 users' names, addresses and birth dates may have been exposed. One fire department says its users' chronic illnesses and medications may be included.
- Phishing has already reached residents. Saitama and Yokosuka learned of the breach when residents reported suspicious emails, and Shizuoka says it has seen a fake credit card email using the alert service's own sender domain.
- Japan's emergency alerts on mobile phones (緊急速報メール), which sound for earthquakes and tsunamis without any sign-up, are a separate system. Several cities list them as a channel still working.
What is SpeeCAN RAIDEN?#
Many Japanese cities and towns run opt-in alert services: residents register an email address, phone number or fax number, and the city sends weather warnings, evacuation orders, missing-person alerts or crime-prevention notices. SpeeCAN RAIDEN is one of the platforms behind them.
| Operator | Arcadia Inc. (株式会社アルカディア), Minoh, Osaka Prefecture |
| What it does | Sends one message to many people at once by email, automated voice call (using speech synthesis) and fax. Cities type in an alert, and the service delivers it |
| Customers | 875 municipalities at the end of September 2026, according to Nikkei. Residents usually know it by their city's own name for it, such as "Shizuoka City Disaster Email" or "Sagan Mail" |
| Related services | Raiden School (ライデン・スクール), for schools to contact parents; 119RAIDEN, for fire departments to alert their staff and volunteer fire corps; and Arcadia's version of NET119, a text-based emergency call service |
So for most people affected, the name they will see is their city's, not Arcadia's.
What happened#
| Date | Event |
|---|---|
| Oct 11, 16:30 | Arcadia finds suspicious activity on SpeeCAN RAIDEN that suggests unauthorized access |
| Oct 12, ~03:00 | Arcadia takes emergency steps to close the intrusion route and starts investigating |
| Oct 13, ~10:30 | Arcadia announces that personal data may have leaked |
| Oct 13, 11:00 | Emergency shutdown of the two services that were the way in: SpeeCAN RAIDEN on the server raiden3.ktaiwork.jp, and Raiden School on s2.ktaiwork.jp. No date for recovery |
| Oct 13, 12:50 | A Saitama resident asks the city about a suspicious email whose sender address contains the system's name. The city calls Arcadia two minutes later and learns of the breach |
| Oct 13, 18:47 | Arcadia says it has identified the intrusion route, blocked the attackers' IP addresses, and checked the servers of services it did not stop for malicious programs, finding none. It gives the maximum numbers |
| Oct 14, 15:00 | Arcadia says it found traces of unauthorized access on NET119 and 119RAIDEN too, and is now checking all its services |
Arcadia has not said how the attackers got in, beyond calling it unauthorized access by a third party. According to ABC TV, it is consulting the Osaka Prefectural Police. The Ministry of Internal Affairs and Communications, which oversees local governments, said on October 13 that some municipalities had reported to it and that it was checking the situation, according to Kyodo News.
What may have been exposed#
| Service | Maximum records | Data |
|---|---|---|
| SpeeCAN RAIDEN and Raiden School | About 3,136,000 email addresses, 105,000 phone numbers and 15,000 fax numbers | Contact names, email addresses, phone and fax numbers; municipal staff in charge and contract details; and the text of messages stored in the sending history |
| NET119 (text-based 119 calls) | About 13,000 | Users' name, date of birth, sex, address, phone, email and fax, and "information entered when registering for other services". Video calls are not affected |
| 119RAIDEN (alerts to fire staff) | About 97,000 email addresses, 17,000 phone numbers and 400 fax numbers | Contact names, email addresses, phone and fax numbers; staff and contract details; stored message text |
Arcadia stresses that the numbers are estimates and that it is still investigating. Payment data is not handled by the service. The services on six domains are named as affected: raiden.ktaiwork.jp, raiden2.ktaiwork.jp, raiden3.ktaiwork.jp, raiden2.speecan.jp, s.ktaiwork.jp and s2.ktaiwork.jp.
Municipalities' own figures show what this means locally:
| Municipality | What it says |
|---|---|
| Shizuoka City | Registrant data "has been found to have leaked": email addresses of 34,336 residents, and names, staff numbers and departments of 6,915 city employees. Its email service for watching over elderly people with dementia had a similar incident. Shizuoka has resumed its alert email |
| Saitama City | 34,783 email addresses for its disaster radio email, and names and phone numbers of 73 people registered for disaster phone calls |
| Kitakyushu City | About 11,000 people: 9,996 email addresses for the fire bureau's information service, and 1,497 staff and residents' names, phone numbers and emails, according to TNC. Its system is running normally |
| Okayama City | Registered email addresses, and names and phone numbers of people who receive dam release warnings. Its alert email and the dam release phone calls are stopped |
| Yokosuka City | Contact data for its disaster and crime-prevention emails; numbers not yet known. It has reported to the Personal Information Protection Commission. Four services are stopped, according to Nikkei |
| Takaoka City | Its disaster email, its multilingual disaster email, its phone and fax alerts, and weather warnings on its website and LINE account are all unavailable |
| Osaki Fire Department (Miyagi) | All 45 NET119 users' names, addresses and phone numbers, plus chronic illnesses and regular medications, may have leaked, according to Miyagi Television. 80 people on a staff alert system are also affected |
| Kakogawa City | About 2,200 records of staff names and email addresses, according to Nikkei |
By the morning of October 14, at least 79 prefectures, cities and towns had posted notices, according to a count by the security blog piyolog. What each one stopped varies: some halted all alerts, some only manual messages or new sign-ups, and some kept sending as normal.
Phishing has already started#
Several cities found out about the breach not from Arcadia but from their residents.
- Saitama: at 12:50 on October 13, a resident asked about a suspicious email with the system's name in the sender address. The city contacted Arcadia two minutes later.
- Yokosuka: registrants of its disaster and crime-prevention emails asked about suspicious emails the same day. The city says spam is already arriving.
- Shizuoka: the city has published an example. The subject is " Please confirm your usage", it claims to come from a real credit card company, asks the recipient to confirm card transactions, and its sender address ends in @raiden.ktaiwork.jp, the same domain the city's real disaster emails come from.
Shizuoka points out a trap: if residents mark that domain as spam or block it, they will stop receiving real disaster alerts too. It says it sends only disaster information from that address.
We checked the domain's public email settings on October 14. It publishes an SPF record that allows only Arcadia's own IP ranges to send, and a DMARC policy of "quarantine". In principle, that should send forged messages from elsewhere to spam folders. Either some mail services delivered them anyway, or the messages went out through Arcadia's own systems. Neither Arcadia nor Shizuoka has said which, and in our view it is the most important open question: a system that can send a fake credit card email to registered residents could, in principle, send a fake alert.
Will I still get earthquake and tsunami alerts?#
Yes, through other channels. The service hit here is the opt-in email, phone and fax alerts that residents register for with their city. Japan's main emergency alerts work differently:
- Emergency alert messages on mobile phones (緊急速報メール, also called エリアメール "Area Mail" on docomo) are sent by mobile carriers to every compatible phone in an area, with no registration. The Japan Meteorological Agency uses them for earthquake early warnings, tsunami warnings and special weather warnings, and cities use them for evacuation orders. Shizuoka and Saga both point residents to them while their own alert email is affected.
- Outdoor loudspeakers (防災行政無線) and city websites and social media accounts are also unaffected, and several cities name them as alternatives.
- Cities that have stopped their alert email, such as Okayama and Takaoka, ask residents to check the Japan Meteorological Agency, prefecture and city websites, TV and radio for weather and evacuation information.
None of the notices we read says the mobile emergency alerts or the national J-Alert system were affected.
NET119: the most sensitive data#
NET119 (Net119緊急通報システム) lets people who cannot make a voice call, mainly those with hearing or speech disabilities, call the fire service from a smartphone: they choose "fire" or "ambulance", their location is sent, and the conversation continues by text chat. Users register in advance with their local fire department, and Japan's Fire and Disaster Management Agency has pushed for every fire department to offer it. Several companies provide it; Arcadia is one.
Arcadia says data for up to about 13,000 NET119 users may have been exposed: names, birth dates, sex, addresses, contact details and information entered at registration. The Osaki Fire Department's example shows what that can mean: its users' chronic illnesses and regular medications, recorded so that crews know what they are facing. Arcadia says NET119 is still working and it has no plans to stop it; Osaki has paused new registrations.
In our view, this is the part of the breach that matters most, even though it is the smallest. Disability and health information belong to the category Japan's privacy law treats as sensitive personal information, where a possible leak must be reported to the regulator even if only one person is affected, and the people affected are among those least able to check a suspicious phone call.
What we don't know yet#
- How the attackers got in, and what the intrusion route was
- Whether the phishing emails were sent through Arcadia's systems, or forged from elsewhere
- Whether any fake alerts were sent, or could have been. No municipality has reported one
- Whether data was actually taken. Shizuoka says its registrants' data leaked; Okayama says no outflow has been confirmed; Arcadia says it may have leaked
- How many people, rather than records, are affected, and how many municipalities
- When the stopped services will return
Our analysis#
One vendor, hundreds of municipalities#
This follows the same pattern as the IDCF Cloud attack the same week: one provider sits underneath hundreds of organizations, and an attack on it becomes an incident for all of them at once. Here the organizations are local governments, and what they lost was a channel they use to tell residents to evacuate.
Japanese municipalities often contract out services like this, and the people registered rarely know who runs them. Many residents will have heard of Arcadia for the first time this week. That makes the notices harder to follow: Saitama's says "disaster radio email", Saga's says "Sagan Mail", and some notices do not name the provider at all.
The notice came from the phishing#
Arcadia found suspicious activity on the afternoon of October 11. Saitama and Yokosuka found out on October 13, when residents started asking about suspicious emails. We do not know when Arcadia told its municipal customers, but at least two learned of it from the people the data belonged to. Under Japan's breach notification rules, local governments have their own duty to report and to notify, so the time it takes a contractor to tell them matters.
A breach that touches alerts is different#
Most breaches we cover expose data. This one also took alert channels offline in the middle of typhoon season: Okayama cannot call people downstream of dams before water is released, and Takaoka has lost its multilingual alerts. Other channels remain, but a city that has to choose between keeping a compromised system running and switching off its alerts is in a bad position either way.
In our view, alert systems should be treated as critical infrastructure, not as an ordinary email service. That means asking contractors how sending is protected, whether a stolen login could send a message, and how quickly the city will be told if something goes wrong.
What this means for readers#
- If you are registered for a Japanese city's disaster or safety emails, expect phishing that looks like it comes from your city, the service, a bank or a card company. Do not click links or enter personal or payment details. Check with the city or company directly.
- Do not block your city's alert address even if spam arrives from it. You may stop getting real alerts. Delete the suspicious message instead.
- Make sure emergency alerts are switched on in your phone's settings, so you receive earthquake, tsunami and evacuation alerts regardless of any sign-up service.
- If you or a family member use NET119, expect a notice from your fire department, and be wary of calls or messages that mention your health or disability.
- If you run a municipal or corporate alert system, ask your provider how message sending is protected, and how you would know if someone else used it.
Japanese terms at a glance#
| Japanese | Reading | Meaning |
|---|---|---|
| 防災メール | bōsai mēru | Disaster alert email (opt-in) |
| 一斉配信 | issei haishin | Mass notification |
| 緊急速報メール | kinkyū sokuhō mēru | Emergency alert message sent to all phones in an area |
| エリアメール | eria mēru | docomo's name for emergency alert messages |
| 防災行政無線 | bōsai gyōsei musen | Outdoor public address loudspeakers |
| ダムの放流通知 | damu no hōryū tsūchi | Notice of dam water release |
| 不審なメール | fushin na mēru | Suspicious email |
| 漏洩した可能性 | rōei shita kanōsei | Possibly leaked |
| 漏えいしたことが判明 | rōei shita koto ga hanmei | Found to have leaked |
| 緊急停止 | kinkyū teishi | Emergency shutdown |
This is a developing story. We will update this article as Arcadia and the municipalities publish more.