Arcadia hacked, Japan's disaster alerts used to send 1.4 million phishing emails - Pasquale Pillitteri
Hackers broke into Arcadia's servers on October 11, 2026, and sent 1.4 million phishing emails two days later using Japan's disaster alert system.
Arcadia, an Osaka-based company that operates SpeeCAN RAIDEN—the service Japanese municipalities use for disaster alerts—confirmed a security breach on October 11, 2026. Hackers exploited a vulnerability in the server hosting message attachments, allowing them to access the system and send 1,423,428 phishing emails on October 13. The emails imitated balance-verification requests from a credit card company.
The attack affected approximately 800 municipalities across Japan that use Arcadia's services. By the evening of October 13, at least 36 local governments had suspended their alert systems. Kagawa Prefecture halted its service at 11:00 on October 13, restored it on October 15, and directed residents to use its civil-protection app during the interruption.
Attack Details
The intrusion began around 6:00 AM on October 11 when attackers exploited a directory path traversal vulnerability to access internal files. By 4:00 PM, they had retrieved configuration files and source code, extracting a secret key used for internal authentication. Using brute-force methods, they gained access to authenticated sessions.
Arcadia detected the breach at 11:00 PM when its database showed abnormal load. The entry point was closed at 3:00 AM on October 12, and database passwords were changed at 9:00 AM. However, a hidden backdoor program remained in the system, which engineers discovered only at 4:00 AM on October 13.
The scale and speed of the attack were beyond what a single person could manage
Data Exposure
Arcadia estimates that up to 3.136 million email addresses, 105,000 phone numbers, and 15,000 fax numbers may have been exposed, along with contact names, contract data, and message history. At least 869,575 phishing emails were sent to addresses not in Arcadia's records, indicating attackers used the company's servers as a relay for their own lists.
The breach extended beyond the main SpeeCAN RAIDEN service. NET119, an emergency call service for deaf and hard-of-hearing individuals with about 13,000 records, was also accessed. Additionally, 119RAIDEN may have exposed up to 97,000 email addresses, 17,000 phone numbers, and 400 fax numbers.
Second Attack
Arcadia experienced a second breach between October 22-23 when attackers used a stolen API account password, cracked through brute force. They exploited a URL parse confusion vulnerability to bypass security checks. The vulnerability was closed at 10:30 AM on October 23, and the API was restored on November 6 with new passwords requiring client reconfiguration.
In response, Arcadia has implemented two-step verification for portal access, commissioned external vulnerability analysis and dark web searches, and reported the incident to Japan's Personal Information Protection Commission. The company warns that exposed contact information may remain in circulation, potentially leading to continued scam attempts.
Related
