Security Guides
Unauthorized Access to Arcadia's SpeeCAN RAIDEN (Up to About 3.136 Million Email Addresses, Estimated): Japanese Municipal Disaster-Alert Registrations May Have Leaked — What Subscribers Should Do
On October 13, 2026, Arcadia Inc. said unauthorized access to SpeeCAN RAIDEN, used by Japanese municipalities for disaster-alert email, may have leaked up to about 3.136 million email addresses (estimate). How to handle fake emails from the real sender domain and check if you are affected.
Who this is for: people who receive disaster-alert, crime-prevention or similar messages sent through SpeeCAN RAIDEN (mostly from Japanese municipalities), people registered with NET119 (a service for making 119 emergency calls without speaking), and municipalities and organisations that rely on an outside service for mass notifications. This article is based on the official announcements of Arcadia Inc. and of municipalities that have disclosed impact. It does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
As of October 14, 2026Not yet known
- Counts per municipality or organisation (Arcadia's counts are estimates under investigation)
- Details of the cause, including how the intrusion happened
- How the NET119/119RAIDEN figure of 'about 13000' relates to the per-item counts
- When the suspended services (raiden3 and s2) will restart
- Results of the investigation covering all of Arcadia's services
Arcadia says it will "promptly announce any new facts in this article as soon as they are found." This article reflects its updates through 17:12 on October 14 (Japan time).
What disaster-alert subscribers should do today
Do not block or mark the disaster-alert sender as spam
According to Shizuoka City, the sender address on the fake emails it confirmed was "〇〇@raiden.ktaiwork.jp". That is part of the genuine sender address used by the Shizuoka City disaster-alert email.
The city warns that if you set the sender of a suspicious email to "block" or "spam", you will also stop receiving the city's disaster information. Just delete the fake emails and leave your receiving settings as they are.
Do not open links or attachments in emails claiming to be from a card company or municipality
The fake email Shizuoka City confirmed had the subject line "＜重要＞ご利用確認のお願い" (Important: Please confirm your usage), posed as a real credit card company, and asked the recipient to confirm card activity. The city says this is one example and asks people to watch for suspicious emails with other subject lines and senders too.
Shizuoka City says the only information it sends from @raiden.ktaiwork.jp is disaster information. If an email from the disaster-alert sender asks you to enter card, bank, password, name or address details, treat it as fake and delete it. Check card activity in the card company's official app or a site you open yourself (how to spot fakes: What is phishing).
Check your municipality's notice to see whether you are affected
Arcadia's announcement does not name the affected municipalities or give counts per municipality. Check the notices on the official website of each municipality whose alerts you registered for (disaster, crime-prevention, fire alerts and so on). The table below lists the municipalities whose official pages we opened and confirmed. Some municipalities say that while their service is suspended they will post information on their website, social media and outdoor disaster radio speakers.
NET119 users: keep using it for emergency calls
On October 14, Arcadia added that user data in NET119 and 119RAIDEN, including names, dates of birth, gender and addresses, may also have leaked. It also said it is not currently considering suspending the service and that it can be used as normal.
Keep using it in an emergency. Do not respond to emails or calls that claim to be from the fire department or a municipality and ask for your registration details, password or bank details; check through the contact listed on the official page of the fire department or municipality you registered with.
For questions, use the contact in the announcement
According to Arcadia's announcement, its personal-information helpline is phone 050-5830-0750 and email info@arcadia.co.jp (9:00 to 17:00 Japan time, excluding weekends, public holidays and the New Year period). For questions about your own registration or when alerts will restart, contact the responsible department of your municipality.
Real disaster alert
…@raiden.ktaiwork.jp
Sends disaster information only (Shizuoka City)
Fake email that was seen
〇〇@raiden.ktaiwork.jp
"Important: Please confirm your usage". Poses as a card company and asks you to confirm card activity
↓ Blocking the sender stops both
What to do: leave your settings alone, and delete anything that is not disaster information (requests to confirm, enter details or click links)
Check whether you are affected (municipal notices)
These are the notices we opened and confirmed on each municipality's official website (as of October 14, 2026). Other municipalities and organisations have also made announcements. If your municipality is not in the table, that does not mean you are unaffected.
Counts are each municipality's own figures. They are counted differently (people whose data is established to have leaked, records that may have leaked, number of registrations), so they cannot be added together. The status column uses each municipality's own wording.
| Municipality | Service | Count (municipality's figure) | Main items (municipality's notice) | Status (municipality's wording) | Service status | Date |
|---|---|---|---|---|---|---|
| Shizuoka City | Shizuoka City disaster-alert email | 34,336 residents / 6,915 city staff | Residents: email address / staff: name, staff number, department | Established that it leaked | Available as normal after interim measures. The city says a similar incident occurred in its dementia-monitoring email service | Oct 14 |
| Yokosuka City | Disaster-information email / fax / phone; crime-prevention email | 47,065 / 996 / 11 / 10,848 people | Email addresses (fax and phone services: names, phone and fax numbers, etc.) | Risk of leak (numbers and scope not yet determined) | All four services suspended. Suspicious spam already confirmed | Oct 13 |
| Saitama City | Disaster radio email / disaster-information phone service | 34,783 / 73 records | Email addresses / names and phone numbers | Possibly leaked (as of Oct 13) | Registrants notified and warned through the service | Oct 13 (first report) |
| Miyazaki Prefecture | Disaster and crime-prevention email service | 38,959 registrations | Registrants' email addresses, etc. | Possible leak (whether and how far prefectural users' data leaked is being checked) | Not stated | Oct 13 |
| Imabari City | Fire-alert email / staff call-out email / volunteer fire corps call-out email | Not stated | Email, area of residence (in or outside the city), age bracket / staff name and email / name and email | Possible leak (no misuse confirmed) | Fire-alert email suspended (restart date undecided) | Oct 13 (items added Oct 14, 16:00) |
Arcadia says 'possibly', Shizuoka City says 'established'
The wording differs depending on who made the announcement. Arcadia says data "may have leaked" across the service, while Shizuoka City says it has "established that" its disaster-alert registrants' data leaked. This article attributes each statement to the organisation that made it. The reliable way to know what happened to your registration is your municipality's notice.
What happened (according to Arcadia)
The following is based on Arcadia's announcement of October 13, 2026, its updates on the same page through October 14, and its notice of the emergency shutdown. Times are Japan time.
October 11, 2026, 16:30
Suspicious activity suggesting unauthorized access is seen on SpeeCAN RAIDEN.October 12, around 3:00
An interim measure blocks the intrusion route, and an investigation into the scope begins.October 13
Arcadia announces that personal data may have leaked (around 10:30, according to Saitama City). At 11:00 it shuts down the services that were the intrusion route (raiden3.ktaiwork.jp for SpeeCAN RAIDEN and s2.ktaiwork.jp for Raiden School) and blocks access from the source IP addresses. It says an inspection of the services it did not shut down found no malicious programs installed.October 13
Yokosuka City, Saitama City, Miyazaki Prefecture, Imabari City and others publish their own notices.October 14, 10:40
Arcadia publishes a sample warning text for administrators (the municipalities and others using the service) to send to their registrants.October 14
Shizuoka City announces it has established that its disaster-alert registrants' data leaked, and warns of fake emails it has seen.October 14, 15:00 to 17:12
Arcadia adds that there were traces of unauthorized access to NET119 and 119RAIDEN and that personal data may have leaked. At 16:00 it corrects this, saying some 119RAIDEN URLs (fs119.speecan.jp and 119r.speecan.jp) are not affected. At 17:12 it says NET119 video reports are not currently at risk. The investigation now covers all services.
- Services in scope (Oct 13)
- raiden.ktaiwork.jp, raiden2.ktaiwork.jp, raiden3.ktaiwork.jp, raiden2.speecan.jp, s.ktaiwork.jp, s2.ktaiwork.jp
- Items (Oct 13)
- Contact names, email addresses, phone and fax numbers / staff and contract information / content of message text stored as history
- Maximum counts (Oct 13)
- About 3,136,000 email addresses, about 105,000 phone numbers, about 15,000 fax numbers. Described as "only estimates," with the investigation continuing
- NET119 and 119RAIDEN (added Oct 14)
- URLs in scope: net119.speecan.jp, net119fd.speecan.jp, fs119.ktaiwork.jp. Items: users' names, dates of birth, gender, addresses, phone numbers, email addresses, fax numbers, information entered when registering for other services, plus contacts, staff and contract information and stored message text
- NET119 and 119RAIDEN counts
- Gives the "maximum count" as "about 13000," then lists "email addresses: about 97000," "phone numbers: about 17000" and "fax numbers: about 400"
- Not included
- Credit card and other payment data (not handled). NET119 video reports (not currently at risk)
- Cause
- "Occurred because a third party carried out unauthorized access." How the intrusion happened has not been disclosed
- Services
- raiden3 and s2 shut down from 11:00 on October 13 (restart date undecided). NET119: no suspension currently being considered; usable as normal
The NET119/119RAIDEN figures in the announcement do not add up
Arcadia's October 14 update gives the "maximum number of personal data records that may have leaked" for NET119 and 119RAIDEN as "about 13000," then gives email addresses as "about 97000." A per-item count is larger than the overall count, and the announcement does not explain how the figures relate (for example, people versus records). We have not reinterpreted either number and show them as published. We will update this when Arcadia explains.
What we know and what we don't
Status as of October 14, 2026. When follow-up announcements come out, we will update the status column.
| Item | What was announced | Status |
|---|---|---|
| Email addresses | Up to about 3.136 million (estimate) | Possible (Arcadia) |
| Phone and fax numbers | Up to about 105,000 / about 15,000 (estimates) | Possible (Arcadia) |
| Contact names, staff and contract information | Listed as items in scope. No count given | Possible (Arcadia) |
| Message text stored as history | Listed as an item in scope | Possible (Arcadia) |
| NET119/119RAIDEN user data (name, date of birth, gender, address, etc.) | Added October 14. A maximum of "about 13000" is listed alongside "about 97000" email addresses and other counts | Possible (Arcadia) |
| NET119 video reports | Not currently at risk | Not included (Arcadia) |
| Credit card and other payment data | Not handled, so not part of the leak | Not included (Arcadia) |
| Passwords | Not mentioned in the announcement | Not stated |
| Shizuoka City disaster-alert registrant data | Email addresses of 34,336 residents; names, staff numbers and departments of 6,915 city staff | Leak confirmed (Shizuoka City) |
| Counts per municipality or organisation | Not given by Arcadia. Each municipality publishes its own | Under investigation |
| Cause and intrusion method | Unauthorized access by a third party. No method given | Not stated |
| Restart | raiden3 and s2: restart date undecided | Under investigation |
What the leaked items can be used for
In general, the following combinations can be misused in these ways. This does not mean it has happened in this case (fake emails that have actually been seen are covered above).
- Email address plus the type of alert registered for: knowing someone subscribes to disaster alerts makes it easy to send fake emails claiming to be from a municipality or about disasters, such as fake relief payments or shelter notices
- Name plus phone or fax number: fake calls or faxes claiming to be from a municipality or the fire department
- Message text stored as history: copying the wording of real notices to make convincing fakes
- Name plus date of birth plus address (NET119/119RAIDEN users): material for contacts that pretend to verify identity in order to extract more information
Emails that look like they come from a genuine sender are not unique to this case. Why the sender shown is not proof of authenticity is explained in Spam from your own email address.
Our view: disaster alerts are messages you cannot switch off, so judge them by content, not sender
The usual defence against fake email is to reject suspicious senders, but that does not work for disaster alerts, because rejecting them also stops the messages you need in a disaster.
What works instead is the rule Shizuoka City gave: this address sends disaster information only. Disaster information is something you just read; it never needs you to confirm a card or enter details on a linked page. If the disaster-alert sender asks you to confirm or enter something, it is fake, even when the sender looks identical.
What municipalities and organisations that outsource mass notifications should review
The details of the cause have not been disclosed, so this section does not assess Arcadia's security. It sets out what organisations that rely on an outside service to send mass notifications to residents, as disaster-alert email does, can check on their own side, based on the published sequence of events and the items involved. How to inventory the data you pass to a mail provider is covered in the JR East, View Card and JR Kyushu email address leak, so this section focuses on points specific to this case.
Decide what real messages look like, in a form residents can be told
Shizuoka City explains that the fake emails used the same domain as the real ones. When the sender cannot tell residents which message is real, what protects them is a clear rule about what real messages contain.
Shizuoka City told residents it only sends disaster information from @raiden.ktaiwork.jp. If you decide in normal times that disaster alerts never ask people to confirm cards or bank accounts or to enter details on a linked page, and say so in your registration guide, you can issue the same warning on the day of an incident.
Always include 'do not block the sender' in your warning
Generic fake-email advice often says "block suspicious senders", but if residents do that with disaster alerts, real disaster information stops too. Shizuoka City's warning states this explicitly. On October 14, Arcadia published a sample warning text for administrators to send to registrants. If you use such a template, check whether to add "please do not block this sender" for your own alerts.
Tell registrants in advance how you will reach them if alerts stop
Yokosuka City suspended four alert services and says that in the meantime it will post information on its website, official social media (X, LINE and others) and outdoor disaster radio speakers. Imabari City points people to a fire-information phone line while its fire-alert email is suspended. Disaster communication cannot simply stop, so tell registrants in normal times what the fallback channels are.
Keep personal data out of message text, and set how long history is kept
Arcadia lists "the content of message text stored as history" among the items that may have leaked. If the text of messages you send stays with the provider, putting names or phone numbers in staff call-out messages or individual notices means those can leak too. Check two things: keep personally identifying information out of message text, and set a retention period for history kept by the provider in your contract.
Treat residents' questions as an early signal
According to Saitama City, a resident asked about a suspicious email at 12:50 on October 13, and two minutes later the city checked with the provider and learned of the unauthorized access. Yokosuka City also says it checked after registrants asked about suspicious emails. Make sure the desk that receives a call saying "I got a strange email" can quickly connect it to the department that runs the alerts and to the provider.
How customers can prepare for an incident at their provider is covered in When your web hosting provider is breached, and another case where one service's breach spread to many client organisations is unauthorized access to Commune.
Sources (public record)
The facts in this article are based on the public information below. We do not speculate about unauthorized-access methods that have not been disclosed. Only municipal notices we opened and confirmed on official pages are listed.
- Arcadia Inc., "SpeeCAN RAIDENへの不正アクセスによる個人情報漏洩の可能性について" (Possible personal data leak due to unauthorized access to SpeeCAN RAIDEN), October 13, 2026 — arcadia.co.jp
- Arcadia Inc., detailed page with the same title (published October 13, 2026, updated 17:12 on October 14) — raiden.site.ktaiwork.jp
- Arcadia Inc., "不正アクセスに伴う一部サービスの緊急停止について" (Emergency shutdown of some services due to unauthorized access), October 13, 2026 — raiden.site.ktaiwork.jp
- Shizuoka City, "【不審なメールにご注意ください】災害時の情報収集への備え" (Beware of suspicious emails: preparing to get information in a disaster), updated October 14, 2026 — city.shizuoka.lg.jp
- Yokosuka City, notice on the risk of a personal data leak in its disaster-information and crime-prevention email services, October 13, 2026 — city.yokosuka.kanagawa.jp
- Saitama City, notice on a possible personal data leak due to unauthorized access to its disaster-information system (first report), October 13, 2026 — city.saitama.lg.jp
- Miyazaki Prefecture, notice on a possible leak of email addresses in its disaster and crime-prevention email service, October 13, 2026 — pref.miyazaki.lg.jp
- Imabari City, notice on a possible personal data leak due to unauthorized access to the operator of its information distribution system, October 13, 2026 (items added October 14) — city.imabari.ehime.jp
Update history
2026-10-14: First version. Based on Arcadia's October 13 announcement and its updates on the same page through 17:12 on October 14, and on five municipal notices. We will update when counts per municipality, the cause, or the restart of suspended services are announced.
Read next
- Spotting fake messages: What is phishing / Spam from your own email address
- Similar cases: JR East, View Card and JR Kyushu email address leak / Unauthorized access to Commune
- Other 2026 incidents: List of data breaches and cyberattacks
FAQ
QWhat leaked in the SpeeCAN RAIDEN incident?
According to Arcadia's announcement of October 13, 2026, the data that may have leaked is what SpeeCAN RAIDEN handles: contact names, email addresses, phone and fax numbers, staff and contract information, and the content of message text stored as history. The maximum counts are about 3.136 million email addresses, about 105,000 phone numbers and about 15,000 fax numbers, which Arcadia describes as estimates under continuing investigation. On October 14 it added that user data in NET119 and 119RAIDEN, including names, dates of birth, gender, addresses, phone numbers and email addresses, may also have leaked.
QAm I affected?
SpeeCAN RAIDEN is used by municipalities and other organisations to send disaster-alert and crime-prevention emails. Whether you are affected depends on which municipality's or organisation's alerts you registered for. Check the notice of the municipality you registered with (the table in this article lists the notices we opened and confirmed on official pages). Municipalities not in the table may also be affected. Arcadia's announcement does not name the municipalities or give counts per municipality.
QI got a suspicious email from the same sender as my disaster alerts. Should I block it?
Do not block it or mark the sender as spam. According to Shizuoka City, the fake emails it confirmed came from an address ending in @raiden.ktaiwork.jp, part of the genuine sender address of its disaster-alert email. The city warns that blocking this sender will also stop real disaster information. Delete the fake email without opening links or attachments. Shizuoka City says the only information it sends from this address is disaster information.
QWas my credit card information leaked?
Arcadia says SpeeCAN RAIDEN does not handle payment data such as credit cards, so it is not part of the leak. However, Shizuoka City has confirmed fake emails with the subject line meaning 'Important: Please confirm your usage' that pose as a real credit card company and ask you to confirm card activity. Check your card activity in the card company's official app or a site you open yourself, not through links in the email.
QWhat caused it?
Arcadia says the incident 'occurred because a third party carried out unauthorized access' and has not disclosed how the intrusion happened. On October 13 it said the intrusion route had been identified, shut down the services that were the route, and blocked access from the IP addresses the unauthorized access came from. We do not speculate about methods that have not been disclosed.
QI am registered with NET119. Can I keep using it for emergency calls?
On October 14, Arcadia said there were traces of unauthorized access to NET119 and 119RAIDEN and that user data such as names, dates of birth, gender and addresses may have leaked. It also said it is not currently considering suspending the service and that it can be used as normal. It says video reports are not currently at risk of having leaked. Keep using it in an emergency. Do not respond to messages claiming to be from the fire department or a municipality that ask you to confirm your registration details or password; check with the fire department or municipality you registered with through its official website.