Arcadia Breach Exposes Data of 13,000 Japanese Police
In short: Osaka-based Arcadia Inc. — a contractor that delivers storm and disaster alerts for hundreds of Japanese municipalities and police departments — was breached. Attackers chained a path-traversal flaw with a secret key left exposed in a config file, planted a backdoor in the SpeeCAN RAIDEN alert system, and used it to send roughly 1.4 million phishing emails. At risk: up to 3.14 million resident email addresses and the personal details of about 13,000 Saitama Prefecture police officers. The incident is a reminder that your data can leak through a vendor you've never heard of — you can check whether your own data has already surfaced in known breaches using the tools in our guide on checking for a personal-data leak.
What happened
On October 11, 2026, Arcadia Inc. detected suspicious activity on its servers. Under contract with the Japanese government, the company operates SpeeCAN RAIDEN, a mass-notification system used by 875 municipalities and agencies — including police — to push disaster alerts about storms, floods, and earthquakes. By the evening of October 13, 36 local governments had reported service disruptions, and Japan's Ministry of Internal Affairs and Communications requested a damage assessment from Arcadia. Full service was only restored on October 15. NET119, a related emergency-call service used by people with hearing and speech impairments, was also affected.
How the breach happened
According to reporting from beyondmachines.net, attackers combined two weaknesses: a path-traversal vulnerability — which lets an attacker escape a server's intended directory and read arbitrary files — and a secret key that had been left hardcoded in a configuration file. Using the path-traversal flaw to reach that key, the attackers installed a hidden backdoor into the alert system and used it not only to exfiltrate data but to send roughly 1.4 million phishing emails from a trusted alert service's own infrastructure, effectively weaponizing the very system meant to protect people.
Scale of the exposure
Arcadia's worst-case estimate puts the exposure at up to 3.14 million resident email addresses, around 105,000 phone numbers, roughly 15,000 fax numbers, plus contact names, contract details, and stored message history. Separately, the personal email addresses and phone numbers of about 13,000 Saitama Prefecture police officers were put at risk — a particularly sensitive subset, since it makes it easier to target the very people investigating cybercrime with spear-phishing or intimidation.
Why this matters even if you're nowhere near Japan
This is a textbook supply-chain incident: nobody attacked the police or municipalities directly — attackers hit a single contractor serving hundreds of organizations at once and got access to all of their data and communication channels in one strike. The same logic applies everywhere: your bank, employer, insurer, or telecom provider can be solid on its own, while handing data to a vendor that stores a secret key in plain text in a config file — and the leak happens without your involvement and often without your knowledge. The only practical response is to stop assuming your data hasn't leaked, check regularly, and expect the wave of phishing that typically follows incidents like this (as in our coverage of tax-authority phishing letters).
How to protect yourself
Check whether your data already appears in known breaches — it takes a few minutes and no special skills; see our guide on checking for a personal-data leak.
Treat emails from 'trusted' services with suspicion after a major incident. Arcadia's own compromised infrastructure was used to send phishing — the same happens with other breached services: an email arriving from a legitimate-looking address is no guarantee the sender itself wasn't compromised.
Use unique passwords and a password manager for every service, so a breach at one vendor doesn't unlock the rest of your accounts — see our guide to choosing a password manager.
Protect your connection on public networks. A VPN can't stop a leak on a vendor's servers, but it does stop your own traffic from being intercepted while you check email or log into accounts over open Wi-Fi in a café, hotel, or airport. LiMP VPN encrypts your connection on Android, Windows, and Chrome under a no-logs policy — see plans.
Sources
Frequently asked questions
How can I find out if my data was in this or a similar breach?
Free breach-check services let you enter an email address or phone number and see whether it appears in known leaked datasets. The step-by-step process is in our guide on checking for a personal-data leak: /en/blog/check-if-your-data-was-leaked.
Will a VPN protect me from a vendor-side breach like Arcadia's?
No. A VPN encrypts your own internet traffic, but it cannot protect data that already sits on a third-party vendor's servers and is breached there. A VPN is useful separately — for example, to stop your traffic from being intercepted on public Wi-Fi while you check email after an incident like this.
What is a path traversal vulnerability and why is it so dangerous?
Path traversal is a class of vulnerability where an application fails to validate the requested file path, letting an attacker escape the intended folder and read arbitrary files on the server — including config files containing passwords and secret keys. In Arcadia's case, that's exactly how attackers stole the secret key that opened backdoor access to the entire alert system.