The system of Arcadia Co., Ltd., which operates the disaster prevention information distribution service “SpeeCAN RAIDEN,” suffered unauthorized access by a third party, leading to potential personal information leaks and service suspensions across more than 79 local governments nationwide. This incident highlights background factors such as the targeting of supply chain vulnerabilities as municipalities rely on external services, as well as the rise of new attack methods originating from application analysis.

Overview of Unauthorized Access and Impact on the Disaster Prevention Information Distribution Service

At 16:30 on October 11, 2026, suspicious access behavior by a third party was detected in the system of Arcadia Co., Ltd., the developer and operator of “SpeeCAN RAIDEN,” a disaster prevention and crime prevention information distribution service. The company implemented emergency measures to block the intrusion route around 03:00 on October 12, and starting from 11:00 on October 13, took measures to emergency-stop some of its distribution infrastructure (such as raiden3.ktaiwork.jp and s2.ktaiwork.jp).

Following further investigations, it has been announced that the estimated maximum number of personal information records subject to investigation across the entire system reaches approximately 3,136,000 email addresses, 105,000 phone numbers, and 15,000 fax numbers.

Due to this situation, it has developed into a suspension of a wide range of critical administrative communication infrastructure, including disaster prevention email distribution that automatically notifies residents of emergency information such as weather warnings and evacuation orders, emergency contact via telephone and FAX, the emergency assembly of municipal officials, and mass notification functions in elementary and junior high schools and childcare facilities.

A wide-ranging impact extending to over 79 local governments and related organizations nationwide

According to official local government announcements and media reports as of the morning of October 14, 2026, at least 79 administrative bodies nationwide (prefectures and municipalities) have successively announced the suspension of disaster prevention email services and the potential leakage of registered information.

Regarding the scale of damage in major municipalities, concerns have arisen regarding the external leakage of registered information, including approximately 34,856 cases of disaster prevention administrative radio emails and others in Saitama City, approximately 38,959 cases of disaster prevention and crime prevention information emails in Miyazaki Prefecture, approximately 39,657 cases in Saga City, Saga Prefecture’s “Sagan Mail,” approximately 37,936 cases combined for emails to residents and the staff safety confirmation system in Oita Prefecture, and approximately 25,566 cases in Kagawa Prefecture.

Furthermore, in Joetsu City, Niigata Prefecture, the leak included not only the email addresses of the general public, but also the contact information of fire brigade members and the names and employee ID numbers of city officials, while in Konan City, Shiga Prefecture, the impact even extended to the facility names of registered users at schools and childcare facilities. Many affected local governments have suspended new registrations and immediate delivery for email distribution, and are scrambling to take emergency measures by switching to alternative means such as official websites, official social media, and Japan Meteorological Agency information.

The Structure of Service Supply Chain Attacks Targeting Supply Chains via Outsourced Vendors

This cyber incident illustrates the classic structure of a “service supply chain attack,” targeting IT companies and service providers handling outsourced operations rather than directly targeting government agencies with robust security measures. Because many local governments relied on a single cloud-based delivery service or operational provider, a single intrusion into the shared system infrastructure resulted in the impact spreading simultaneously to numerous municipalities nationwide.

Moreover, as seen in the case of Miyazaki Prefecture, a hierarchical outsourcing relationship has also come to light, where a local government outsourced operations to NEC Networks & System Integration Corporation, which in turn used Arcadia Co., Ltd.’s system as the actual operational infrastructure. As shown in the diagram below, such complex management structures involving contractors and subcontractors tend to create security blind spots.

On October 7, 2026, the Personal Information Protection Commission (PPC) also issued an alert, strongly warning about the risk that connection points in a network—such as outsourced vendors, group companies, and overseas bases—can serve as entry paths for attackers.

The Reality of the Damage and the Underlying Cyber Threats

Personal Data at Risk of Leakage and the Risk of Secondary Damage

The personal information that may have been leaked due to this unauthorized access includes residents’ email addresses, names, phone numbers, addresses, dates of birth, fax numbers, and the body text of past email distribution history. Although the actual number of confirmed leaks is still under investigation, signs of malicious secondary damage targeting residents have already begun to appear.

In Yokosuka City, Kanagawa Prefecture, and Saitama City, there has been a series of inquiries from residents reporting that they received suspicious emails from senders with names resembling streaming services or local municipalities. The risk of phishing scams is escalating, as attackers exploit stolen contact information to lure targets to fraudulent websites by posing as disaster prevention alerts, system recovery procedures, or notices of unpaid fees, with the intent of stealing IDs, passwords, and financial account details.

According to the damage cost survey report by the Japan Network Security Association (JNSA), response costs in the event of a personal information leak—such as investigating the cause of the incident, setting up a call center, sending compensation payments, and formulating recurrence prevention measures—are analyzed to range from tens of millions to hundreds of millions of yen even for small and medium-sized businesses, bringing massive economic damage along with the loss of social trust.

Latest techniques such as A2B attacks that target servers through app analysis

As a technical factor behind this incident, attention is focused on its connection to the latest cyber attack methods—such as the “A2B Attack” (App-to-Backend Attack), about which the National Institute of Information and Communications Technology (NICT) issued a warning on October 13, 2026.

An A2B attack is a method in which publicly available smartphone apps (Android or iOS) undergo reverse engineering or static analysis to decipher API communication procedures, authentication keys, and server connection information embedded within the app, subsequently launching direct intrusions and attacks against the backend database server. As shown in the diagram below, vulnerabilities in the integration points between the application and the server are targeted.

In recent years, the rapid evolution of generative AI tools has dramatically streamlined tasks such as source code analysis and vulnerability detection, enabling attackers to execute sophisticated intrusion methods with minimal effort. If flaws in access control and authentication logic for an application’s APIs are left unaddressed, there is a severe risk that vast databases could be leaked all at once.

Future Defense Measures and Key Focus Areas Required for Local Governments and Businesses

Moving forward, the top priority required for local governments and private businesses is to reconstruct security controls that do not depend on a single service provider or contractor, and to ensure thorough risk management across the entire supply chain. Under the amended Act on the Protection of Personal Information, in the event of a data breach, it is mandatory to submit preliminary and confirmed reports to the Personal Information Protection Commission and to promptly notify the affected individuals.

Specific technical defense measures include thorough access restrictions for public applications and Web APIs, the implementation of regular vulnerability assessments, the standardization of multi-factor authentication (MFA), and thorough data encryption. In addition, rather than relying solely on contractual arrangements, it is essential to regularly verify the actual status of information storage locations and log retention, including those of subcontractors.

Furthermore, to ensure that the transmission of evacuation information to residents is not interrupted in the event of meteorological disasters or emergencies, formulating a multiplexed BCP (Business Continuity Plan) that combines disaster prevention administrative radio systems, official social media, municipal websites, and offline communication channels—without relying solely on digital email delivery—along with conducting regular operational drills will be an important focus going forward.

Reference page

• [Regarding the Possibility of Personal Information Leakage Due to Unauthorized Access to SpeeCAN RAIDEN (Arcadia Co., Ltd.)] https://www.arcadia.co.jp/info/4076
• [Cautionary Alert for the Prevention of Personal Data Breaches Due to Unauthorized Access (Personal Information Protection Commission)] https://www.ppc.go.jp/files/pdf/261007_houdou.pdf
• Publication regarding registration information for the Miyazaki Prefecture Disaster Prevention and Crime Prevention Information Email (Miyazaki Prefecture)
• 【Impact on Registrant Information Due to Unauthorized Access to Contractor Arcadia (Yokosuka City)】https://www.city.yokosuka.kanagawa.jp/0525/nagekomi/20261013_roueinoosore.html
• [Announcement Regarding Disaster Prevention Information Distribution Service (Saitama City)] https://www.city.saitama.lg.jp/006/014/008/003/015/007/p134471.html

【#Cybersecurity #DataBreach #UnauthorizedAccess #SupplyChainAttack #DisasterPreventionSystem #A2BAttack】