Now What Happens to Trust in Authorities?

The Arcadia breach turned a disaster-alert system trusted by local governments and police into a phishing machine, and left contact lists for police staff and residents in attackers’ hands.

October 21, 2026

When your city or prefectural police send you an earthquake warning, an evacuation order or a crime alert, you are expected to trust it without thinking twice. That is the whole point of an alert system.

So what happens to that trust after the breach at Arcadia Inc., the Minoh, Osaka-based company that runs those alert services for hundreds of local governments? The honest answer is that it can no longer be automatic. It has been broken in at least three ways, and each needs a different response.

Level 1: You can’t trust the decisions behind the system

Arcadia’s SpeeCAN RAIDEN platform was used by 875 local governments at the end of September. The company says up to about 3.14 million email addresses, about 105,000 phone numbers, about 15,000 fax numbers and stored message content may have leaked, figures it calls estimates (Arcadia; Nikkei for the 875 figure). By October 15, 192 local governments had told the Ministry of Internal Affairs and Communications about suspended alerts or possible leaks (Kyodo/47NEWS).

Police forces used it too. On October 21, the National Police Agency said data on officers and staff at 22 of Japan’s 47 prefectural police forces may have leaked: about 125,000 names and email addresses at 20 forces, plus resident crime-alert subscribers at four forces (Kyoto, Fukuoka, Shimane and Yamaguchi) (Kyodo via Mainichi). Twenty forces used Arcadia’s staff safety-check system and four its resident alert system; Kyoto and Fukuoka used both. Jiji’s “over 18,000” resident entries are about 16,000 individuals plus about 2,600 companies (Jiji).

How did the attacker get in? Arcadia’s own October 19 report is specific (Arcadia report, PDF). The server that publishes alert attachments had a directory path traversal flaw, a basic bug that let outsiders reach internal files. The attacker took a configuration file holding the secret key the services used to log in to each other, used it to brute-force account IDs, and pulled internal data. Its minute-by-minute log shows about ten hours of open probing (login attempts, SQL-injection checks, path-guessing) before the file was taken. After the breach, Arcadia says it has now set separate database passwords for each service. Two-step authentication and stronger monitoring are still only plans.

These are basic questions any technically literate buyer asks before handing over a resident mailing list. Can the public reach internal files? Do services share passwords? Is there two-step login? Would ten hours of open probing set off an alarm? Local governments and police forces chose this vendor and were responsible for overseeing it. The public record does not show that anyone asked these questions or checked the answers. Ordinary people now face scams aimed at their card and bank details because of a procurement decision they had no part in.

Level 2: The protector was turned into the attacker

The attacker did not just copy data. A malicious program sent phishing out of Arcadia’s real alert system: the same system that delivers earthquake, evacuation and crime alerts. Arcadia’s count is 1,423,428 fraudulent emails, sent between 01:17 and 07:16 on October 13. Most looked like a credit-card company’s balance check, and Arcadia calls them suspected phishing (Arcadia report, PDF). In an update today, Arcadia added that at least 869,575 of those emails went to addresses Arcadia does not hold. So the alert system was also used to phish people who never signed up for it. An outside firm will now check the dark web (Arcadia, update 17).

Shizuoka City confirmed on October 13 that people on its disaster-mail list were receiving them (Shizuoka City):

Subject: “＜重要＞ご利用確認のお願い” (Important: please confirm your usage)
Posing as: a real credit-card company, asking you to confirm card activity
Sender address: on @raiden.ktaiwork.jp, which Shizuoka confirms is part of the real sender address its disaster mail uses

Sasebo City reported similar emails claiming a large charge and pointing to a “confirmation” site (Sasebo City). Both cities told residents not to open the links or attachments.

Shizuoka’s exposure shows how much is in these lists: 34,336 residents’ email addresses, 6,915 city staff (email, name, staff number and department), and 1,779 people registered for its dementia missing-person alerts (Shizuoka City, above).

Now think about standard advice: “Check the sender.” “Look for SPF, DKIM and DMARC.” Those checks confirm an email came from the domain it claims. These came from the real system, with the real domain in the sender address. Arcadia’s own timeline lists, at 00:10 on October 13, a “mail sending test (DKIM, DMARC, etc.).” That is one hour before the fraudulent sending began. The report does not say who ran it. When the trusted sender itself is hijacked, sender checks stop protecting you.

The timeline, and what is still unclear. From Arcadia’s own report (PDF):

Oct 11, 06:26: the attacker starts probing. 16:39: the configuration file with the login key is taken. 23:40: Arcadia notices abnormal database load. Arcadia’s public notices, and the cities quoting them, say suspicious activity was confirmed at 16:30. Arcadia has not explained why its two accounts differ.
Oct 12, ~03:00: Arcadia blocks the entry route and fixes the file-server flaw. 09:30: it changes database passwords. 17:05: it finds a WordPress plugin that someone had added.
Oct 13, 01:17: the phishing starts anyway, nearly a day after the “block.” It begins with batches of about 5 emails and grows to batches of 1,000. 04:10: Arcadia finds a backdoor (a hidden way back in) because of the mass sending. 07:16: the sending stops. 11:00: the affected servers are shut down.
Oct 13 to 14: intrusion traces turn up in the NET119 and former 119RAIDEN emergency-service databases and an internal accounting system; data in one database had been altered.

So the phishing went out after the entry route was blocked, through a way back in that was still open. Arcadia still has not said when the backdoor was put in place. Nor has it said whether the WordPress plugin was related. So we do not know how long the attacker had hidden access, or whether “blocked” meant what residents assumed. Today Arcadia also asked customers to reissue the keys connecting RAIDEN to their LINE accounts and to reconnect X and Facebook (Arcadia, update 15).

Level 3: The attacker doesn’t need the system anymore

Arcadia restored its services on October 15. The risk remains, because the contact lists are already gone.

Attackers now hold real names and email addresses of police officers and staff. According to Jiji, most are personal phone addresses, and some forces (including Tochigi and Saitama) also stored each person’s unit. They also hold lists of residents who chose to get police crime alerts. With that, they can send targeted phishing from anywhere:

fake breach notices (“your data was leaked; verify your identity here”)
fake police messages, aimed at residents who already expect police mail
lures aimed at officers’ personal phones, styled as a headquarters instruction or a “safety-check system re-registration”

ILLUSTRATIVE EXAMPLE ONLY. This is not a real email that has been seen. Subject: 【重要】防犯メール登録情報流出に関するご本人確認のお願い (Important: identity check following the crime-alert email data leak) “○○ ○○ 様: Because of unauthorized access at our contractor, your registration may have leaked. Re-register within 48 hours at the link below, or alerts will stop.” → link to a lookalike site.

Sasebo City already warns that emails posing as the city or the vendor should be expected. The NPA says no misuse of the police data has been confirmed yet (Jiji, above).

This fits a wider pattern this autumn: contact lists taken through vendors, and entry through stolen logins, as at Astemo (Astemo), NEC’s subcontractor (Asahi) and PingCAP (PingCAP). The Japan Cyberattack Tracker currently lists 41 organizations hit downstream of Arcadia alone.

What to do

The one rule for everyone: never act on a link in an alert email. Not from your city, the police, a “card company” or a breach notice. If a message asks you to do something, close it and go directly to the official website or app you already use. It is the only check that works against both a hijacked sender and a convincing fake.

Residents on alert lists: expect emails that use your name and mention this breach. Never enter card, bank or login details from an email; check with your city or police via their official site. Shimane police give the same advice (Shimane Prefectural Police).

Officers and staff: treat messages on your personal phone that claim to be from headquarters or “the safety system” as suspicious until you confirm them through a channel you already know. Report MFA prompts you didn’t trigger right away.

Organizations using alert or email vendors:

Know what your vendors hold, and ask the questions from Level 1 in writing before you sign, then every year.
Enforce SPF, DKIM and DMARC on your own domain so attackers can’t fake it. Check yours with the Domain Exposure Check. But be honest about the limit: domain authentication cannot stop a hijacked vendor sending as itself.
Have vendors send from a subdomain you control and monitor, so unusual volume is visible to you and you can revoke it.
Agree a “stop all sending” procedure with the vendor in advance, and test it.
Require phishing-resistant MFA on every contractor and service account, and keep login secrets out of files the public can reach.

So, now what happens to trust in authorities? For now, it has to become trust you check. Trust the warning, but not the link. Trust the channel you opened yourself, not the one that reached you. That is a real loss, because an alert people have to second-guess works less well in an emergency. Getting automatic trust back is not the residents’ job. It has to start with the local governments and police forces that choose and oversee these vendors: asking the technical questions, demanding the answers in writing, and telling the public plainly what went wrong.

Matthew Ketchum is a Tokyo-based IT infrastructure advisor. The Japan Cyberattack Tracker follows supply-chain incidents as they are disclosed.