Arcadia Breach May Expose 125,000 Japan Police

The system was built for the worst day: an earthquake or flood, when a prefectural police force needs to know within minutes which officers are safe and who can report for duty. Now the contact list behind it may have been exposed.

Personal information on about 125,000 officers and staff at 20 prefectural police forces may have been compromised in a cyberattack on Osaka-based cloud provider Arcadia, sources at the National Police Agency (NPA) told Jiji Press, as reported in English by The Japan Times. More than 18,000 email addresses of people and businesses that signed up for police crime alerts might also have been exposed. No misuse of the data has been confirmed. The story sits in TSN’s Ransomware & Cyber Attacks hub.

In brief

About 125,000 officers and staff at 20 forces may have had names and email addresses exposed, NPA sources told Jiji.
More than 18,000 crime-alert subscriber addresses may also be affected; Kyodo counts 22 forces in all.
Arcadia estimates up to about 3.1 million email addresses across its disaster-alert service; no misuse has been confirmed.

Most of the exposed addresses are believed to be personal

The forces, including those in Aichi, Hyogo and Hiroshima, had outsourced their emergency safety-check system to Arcadia, which is based in Minoh, Osaka Prefecture. The data potentially exposed is the names and email addresses registered with it. Because the system was designed for emergency contact, most of those addresses are believed to be personal accounts on private mobile phones, according to the Japan Times report. Some forces, including Tochigi and Saitama, had also registered which department each employee works in.

Four forces, including Shimane and Yamaguchi, also used Arcadia to send crime alerts to the public. Those systems held the names and email addresses of about 16,000 individuals and more than 2,600 addresses belonging to companies and other organisations. Kyoto and Fukuoka police used both services.

That overlap explains a difference in the numbers. Kyodo News puts the total at 22 prefectural forces, “nearly half of the country’s 47”, which matches 20 forces on the safety-check system plus the crime-alert users. In Kyodo’s Japanese report, the NPA said no leak of investigative information has been confirmed and that it is still working to confirm the facts.

The NPA has told the affected forces to gather information and warn people about the risk of further harm.

The police data is a small slice of a far larger incident

Arcadia’s own incident page shows how much wider the problem is. The company says it spotted suspicious behaviour suggesting unauthorised access to its SpeeCAN RAIDEN mass-messaging service at 16:30 Japan time on 11 October (08:30 BST), blocked the intrusion route around 03:00 the next morning and shut down affected services at 11:00 on 13 October (03:00 BST). Its estimate of the maximum exposure across the service was about 3,136,000 email addresses, roughly 105,000 phone numbers and some 15,000 fax numbers, though it stresses the figures are estimates. It says it handles no card payment data. A later update said its NET119 emergency-call and 119RAIDEN fire-service tools also showed signs of unauthorised access.

SpeeCAN RAIDEN is the platform many Japanese towns use to push disaster warnings. As of late September, 875 local governments used it, and by 14 October 110 had reported suspensions or possible leaks to the communications ministry, Kyodo reported via The Mainichi. Arcadia posted a fresh notice on 21 October apologising and pointing customers to its rolling updates. It has not said who was behind the attack or how the attackers got in.

Kyodo placed the police leak among “a string of similar incidents at Japanese companies”, and TSN has covered several this month, from Hankyu Hanshin’s H2O ID membership scheme to Kirin’s FANCL online shop. What sets this one apart is the target: the mostly personal email addresses of police officers, held in a system meant to reach them when everything else has failed. The NPA has now told the forces to arrange another way to contact their own staff in an emergency.