--- title: "Arcadia SpeeCAN RAIDEN service intrusion" description: "Arcadia’s SpeeCAN RAIDEN intrusion exposed contact-data risks and enabled malicious email sending; Hikone reported downstream impact." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-13" canonical_url: "https://www.ally.security/incidents/arcadia-speecan-raiden-service-intrusion-2026" markdown_url: "https://www.ally.security/incidents/arcadia-speecan-raiden-service-intrusion-2026.md" stix_url: "https://www.ally.security/incidents/arcadia-speecan-raiden-service-intrusion-2026/stix.json" --- # Arcadia SpeeCAN RAIDEN service intrusion Arcadia’s SpeeCAN RAIDEN intrusion exposed contact-data risks and enabled malicious email sending; Hikone reported downstream impact. Last modified Nov 13, 2026 · 2 sources ## Summary - **Environment:** Public-information and emergency-message services - **Operational impact:** Temporary service restrictions and malicious email sending - **Financial impact:** No confirmed incident cost quantified ## What happened [Arcadia](https://www.arcadia.co.jp/) detected suspicious activity October 11, 2026 and stopped affected SpeeCAN RAIDEN and school-service environments October 13. Its [response chronology](https://raiden.site.ktaiwork.jp/archives/4597) also linked later malicious email sending to the intrusion. [2](#source-2) ## Impact - On October 13, Arcadia estimated possible exposure of about 3,136,000 email addresses, 105,000 telephone numbers and 15,000 fax numbers. Contact names, contract details and stored messages were also potentially involved. These are estimated records, not unique people. [2](#source-2) - Its systems sent 1,423,428 unauthorized phishing messages October 13; at least 869,575 went to addresses it did not hold. Sent messages are not leaked-record counts. [2](#source-2) - [Hikone](https://www.city.hikone.lg.jp/) reported possible exposure of 23,923 resident email records and other administrative contact records, including 41 historic missing-person notifications. These downstream categories are not added to the provider estimate. [1](#source-1) ## Timeline ### October 11, 2026 — Suspicious activity detected An emergency access block followed early October 12. [2](#source-2) ### October 13, 2026 — Affected services stopped Arcadia stopped selected environments. [2](#source-2) ### October 23, 2026 — Follow-on mail abuse stopped Arcadia fixed the defect enabling further API abuse. [2](#source-2) ### November 6, 2026 — External API integration resumes Customers needed configuration changes. [2](#source-2) ### November 12, 2026 — Hikone publishes third notice The city reported downstream exposure risks and notification progress. [1](#source-1) ### November 13, 2026 — Briefing updated This briefing was last reviewed and updated on November 13, 2026. ## Threat Group & Attack Vector Arcadia said exposed mail-API accounts, password guessing and a URL parsing inconsistency enabled October 22–23 email abuse after integration was disabled. [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1110 — Brute Force](https://attack.mitre.org/techniques/T1110/): Arcadia described password guessing against exposed mail-API accounts. [2](#source-2) ## Response Arcadia added two-step login verification and reported to Japan’s [Personal Information Protection Commission](https://www.ppc.go.jp/). [2](#source-2) Hikone’s [November 12 third report](https://www.city.hikone.lg.jp/shisei/koho/press_release/8/11/31145.html) described notifications and continued suspension of nonemergency emails; emergency warnings remained available. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Hikone information-distribution system exposure third report official · City of Hikone · Nov 12, 2026 ### Arcadia service intrusion and response updates official · Arcadia Co., Ltd. · Oct 13, 2026
Evidence ledger Review the supporting structured claims. 1. **Disclosed At · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: 2026-10-13 2. **Occurred At · 100% confidence · current** External API integration resumes: 2026-11-06 3. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: Suspicious activity detected 4. **Affected Organization · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: City of Hikone 5. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: Arcadia linked October 22–23 malicious email sending to mail-API accounts exposed during the October 11–13 intrusion, password guessing and subsequent abuse of a URL parsing inconsistency after API integration was disabled. It fixed that defect October 23 and stopped the messages. 6. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: On October 13 its systems sent 1423428 unauthorized phishing messages; at least869575 went to addresses not held by Arcadia. These sent-message counts do not measure leaked records. 7. **Occurred At · 100% confidence · current** Suspicious activity detected: 2026-10-11 8. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: Hikone also listed41 historic missing-person notification records containing personal details in message bodies. The provider was still investigating the full scope. 9. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: Arcadia detected suspicious activity October 11 at 16:30 and applied an emergency block around03:00 October 12. It stopped affected SpeeCAN RAIDEN and school-service environments October 13 at 11:00. 10. **Affected Organization · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: Arcadia Co., Ltd. 11. **Vendor Of · 100% confidence · current** Arcadia Co., Ltd.: City of Hikone 12. **Occurred At · 100% confidence · current** Hikone publishes third downstream notice: 2026-11-12 13. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: Affected services stopped 14. **Occurred At · 100% confidence · current** Follow-on mail abuse stopped: 2026-10-23 15. **Occurred At · 100% confidence · current** Affected services stopped: 2026-10-13 16. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: Hikone publishes third downstream notice 17. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: Follow-on mail abuse stopped 18. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: External API integration resumes 19. **Used Attack Technique · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: https://attack.mitre.org/techniques/T1110/ 20. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: Arcadia introduced two-step login verification, submitted consenting agencies’ reports to the privacy regulator October 23, and resumed external API integration November 6 with customer configuration changes. 21. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: Hikone’s November 12 report identified possible exposure of 23923 resident email-address records and separate records for associations, facilities, officials and staff. Those categories are not combined into a unique-person total. 22. **Discovered At · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: 2026-10-11 23. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: Hikone had contacted reachable affected groups and continued suspending nonemergency email distribution; emergency warnings remained available. 24. **Resulted In · 100% confidence · current** Arcadia SpeeCAN RAIDEN service intrusion: Arcadia estimated possible exposure of approximately 3136000 email addresses, 105000 telephone numbers and15000 fax numbers in SpeeCAN RAIDEN. Contact names, contract details and stored message content were also potentially involved. The estimates were not unique-person counts.