Japan Probes Cyberattack on Disaster Alert Firm as 3.13 Million Email Addresses Potentially Exposed

Osaka police are looking into a cyberattack on Arcadia, a company that sends disaster alerts for Japanese local governments. Arcadia handed police a written damage report on Nov. 2, Nikkei News reported Wednesday.

Police suspect a violation of Japan’s law against illegal computer access. Officers are now studying network records from the first day of the attack.

How the Attack Unfolded

The attack began early on Oct. 11, during a three-day holiday weekend. The hackers got inside by about 4 p.m. that day. Arcadia did not spot the attack for roughly 17 hours. Then an unusual strain on its database set off an alarm late that night.

The company’s report explains the break-in. Hackers found a flaw in a server that handles file attachments. The flaw let them open a settings file. That file held a secret key the company’s systems used to trust each other. The hackers then guessed account IDs until one worked.

Attackers Planted a Back Door

Arcadia blocked that entry point around 3 a.m. on Oct. 12. Still, the hackers had left a hidden back door. About 21 hours later, they used it to start sending mail.

Between 1:17 a.m. and 7:16 a.m. on Oct. 13, Arcadia’s system sent 1,423,428 fake emails. Many looked like card company notices about unpaid bills. Arcadia suspects it might be a phishing attack. Staff found the back door at 4:10 a.m. and stopped the mail three hours later.

Arcadia says at least 869,575 of those emails went to addresses it does not hold. So the scam reached far beyond its own customer lists.

The cleanup caused trouble too. Arcadia changed passwords to lock the hackers out. That move broke links to some fire information systems. Meanwhile, many local governments paused their alerts. Mainichi reported that the communications ministry counted 110 of them at one point. All services came back on the afternoon of Oct. 15.

AI may have Helped Carry Out the Attack

President Seiichi Tenpaku held a news conference in Tokyo on Oct. 23. He apologized and said the company had damaged public trust. He described the attack as repeated guessing that a person would have given up on. In his view, breaking in within about 10 hours was “not something a human could do.” He said AI may have been used.

Still, Arcadia has not confirmed that claim. Nobody has been named as the attacker, and no group has claimed credit.

What Arcadia does

Arcadia works from Minoh, a city in Osaka Prefecture. Its main service, SpeeCAN RAIDEN, lets towns send evacuation notices and weather warnings by email. At the end of September, 875 government bodies used its services, including local governments and fire departments. So did 242 companies and 584 schools.

Who may be Hurt by the Incident

Arcadia says up to 3.136 million email addresses may have leaked. That figure counts addresses, not people, so some people may appear more than once. Up to 105,000 phone numbers may be out as well.

Police data is at risk too. On Oct. 21, the National Police Agency said 22 regional police forces may have lost personal data. Twenty of them used the service to check on staff during disasters. About 125,000 names and addresses from those systems may have leaked.

In addition, four forces held about 16,000 resident addresses signed up for crime alerts. Police have not confirmed any leak of case files. Hiroshima police alone flagged about 5,700 officers and staff, Kyodo reported. Saitama police put their figure near 13,000, according to Jiji Press.

Another Arcadia service, NET119, lets people with hearing or speech disabilities report emergencies by text. Hackers left traces there as well. Arcadia first said up to 13,000 users could be at risk. Later it counted 9,020 records tied to email. Names, birth dates and addresses may have leaked. Video calls on the service were not affected, Arcadia says.

What’s Next

Arcadia has not set a compensation plan. An official said the firm is talking with lawyers. The hackers were still probing its systems on Oct. 23, and the company said it might shut services down again.

Meanwhile, Arcadia has added two-step login and automatic monitoring. It plans outside tests for weak spots. It is also weighing AI-based defenses. Additionally, the firm encouraged users to change their passwords immediately.

Meanwhile, Arcadia has added two-step login and automatic monitoring. It plans outside tests for weak spots. It is also weighing AI-based defenses. These measures come as Japan pushes to strengthen its national defenses, with a new cybersecurity policy aimed at detecting cyber threats earlier. Additionally, the firm encouraged users to change their passwords immediately.

Residents should stay alert. Arcadia has not emailed them itself. Instead, local governments and other customers are passing on warnings. Treat any card-balance email with caution, even if it seems to come from a town or school alert service.

Do not click its links. Go to your card company’s website directly. Tenpaku has said Arcadia will cooperate fully with police.