Science & Tech · Cybersecurity · 2 hrs ago
Arcadia says cyberattack may have exposed users’ and emergency workers’ data
Arcadia, an IT company in Osaka, said attackers broke into its disaster-information services used by municipalities.
The attack began on October 11, when the intruders exploited a flaw to obtain a configuration file containing a secret key used between services.
Arcadia detected the intrusion about 17 hours after it began, but the attackers had also installed a backdoor.
Through it, an unauthorised program sent more than 1.42 million emails, many resembling credit-card balance notices.
Personal data may have been exposed, including up to 3.136 million user email addresses and contact details for emergency workers and users of a service for people with hearing or speech disabilities.
Police staff in Kanagawa and Tochigi may also be affected, though the extent of the possible disclosure is not clear.
Arcadia restored all services on October 15 and says it will seek outside security checks, strengthen protections and continue working with authorities.
Arcadia said a cyberattack may have exposed personal information, including email addresses of users and contact details of firefighters.
The attack began on October 11, and Arcadia detected it about 17 hours later after noticing unusual database load.
The attacker obtained a configuration file containing a secret key, then used it to access internal information.
A backdoor remained after Arcadia blocked the initial entry route and was used to send more than 1.42 million emails.
Arcadia said all services were restored on October 15 and that it was pursuing further security reviews.
- Who
- Arcadia, an IT company operating municipal emergency-information services, was attacked. Users and emergency workers may have had personal information exposed.
- What
- A cyberattack may have exposed data, including up to about 3.136 million SpeeCAN RAIDEN users’ email addresses. A backdoor was also used to send 1,423,428 emails.
- When
- The attack began on October 11, 2026. Arcadia detected it that day and restored all services on October 15.
- Where
- The affected services included SpeeCAN RAIDEN and NET119 in Japan.
- Why
- The attacker exploited a directory traversal vulnerability on a media server and obtained a secret key. The attacker’s motive is not stated.
This story does not have two clearly opposing sides.
The attacker began attempts to access Arcadia’s systems.
The attacker obtained the config.ini file containing a service login secret key.
Arcadia detected the intrusion after noticing unusual database load.
Arcadia blocked the initial route used to enter the system.
Arcadia discovered a backdoor after unauthorized emails began to be sent.
Arcadia restored all services.
- Attack duration
- About 105 hours from the start of the attack to full service restoration
- Potentially exposed email addresses
- Up to about 3,136,000 SpeeCAN RAIDEN users
- Unauthorized emails sent
- 1,423,428
- Affected emergency service
- NET119, a 119 call system for people with hearing or speech disabilities
- Service restoration
- October 15, 2026, at 3:10 p.m.