Summary
- Environment: Public-information and emergency-message services
- Operational impact: Temporary service restrictions and malicious email sending
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 13, 2026; updated as evidence emerges.
What happened
Arcadia detected suspicious activity October 11, 2026 and stopped affected SpeeCAN RAIDEN and school-service environments October 13. Its response chronology also linked later malicious email sending to the intrusion. [2]
Impact
- On October 13, Arcadia estimated possible exposure of about 3,136,000 email addresses, 105,000 telephone numbers and 15,000 fax numbers. Contact names, contract details and stored messages were also potentially involved. These are estimated records, not unique people. [2]
- Its systems sent 1,423,428 unauthorized phishing messages October 13; at least 869,575 went to addresses it did not hold. Sent messages are not leaked-record counts. [2]
- Hikone reported possible exposure of 23,923 resident email records and other administrative contact records, including 41 historic missing-person notifications. These downstream categories are not added to the provider estimate. [1]
Timeline
Suspicious activity detected
An emergency access block followed early October 12.
[2]Affected services stopped
Arcadia stopped selected environments.
[2]Follow-on mail abuse stopped
Arcadia fixed the defect enabling further API abuse.
[2]External API integration resumes
Customers needed configuration changes.
[2]Hikone publishes third notice
The city reported downstream exposure risks and notification progress.
[1]Briefing updated
This briefing was last reviewed and updated on November 13, 2026.
Threat Group & Attack Vector
Arcadia said exposed mail-API accounts, password guessing and a URL parsing inconsistency enabled October 22–23 email abuse after integration was disabled. [2]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1110 — Brute Force: Arcadia described password guessing against exposed mail-API accounts. [2]
Response
Arcadia added two-step login verification and reported to Japan’s Personal Information Protection Commission. [2] Hikone’s November 12 third report described notifications and continued suspension of nonemergency emails; emergency warnings remained available. [1]