On October 19, Arcadia published a detailed timeline of an intrusion into its emergency and public-notification services, including SpeeCAN RAIDEN. An ITmedia report published on October 20 says the malicious activity lasted about 105 hours from the start of access on October 11 until full restoration was announced on October 15. Arcadia estimates that contact details may have been exposed and says malware sent more than 1.4 million emails.
SpeeCAN RAIDEN helps municipalities distribute information by email, phone or fax. Some local authorities suspended or reported outages affecting certain channels. The incident therefore concerns personal data, technical access and continuity of public communications.
An intrusion that began with a file server
According to Arcadia's timeline, as reported by ITmedia, the activity began on the morning of October 11. The attacker explored several functions on a server used to publish attachments. A directory traversal flaw allowed access to an internal URL and files that were not meant to be public.
A recovered configuration file contained a secret key used for service-to-service sign-ins. The attacker used it to continue login attempts and access internal information. The timeline describes a vulnerability and a secret exposed in a file; it does not establish that users' passwords were stolen.
Late detection followed by a large email send
Arcadia places its first detection at 11:40 p.m. on October 11, about 17 hours after the first attempts described. The operator blocked the access route during the night, but a backdoor remained. On October 13, malware began sending messages in batches; Arcadia counted 1,423,428 emails.
The company suspects a phishing campaign. The reported volume is confirmed in the incident account, but the sources do not say that every recipient was defrauded. The fraudulent emails should not be confused with routine emergency alerts sent by local authorities.
Contact details may have been exposed
Arcadia estimates that data potentially involved in SpeeCAN RAIDEN includes up to 3.136 million email addresses, 105,000 phone numbers and 15,000 fax numbers. It also reported data in NET119 and 119RAIDEN, including names, dates of birth, addresses, contact details and information entered during registration. These are estimated maximum scopes, not confirmation that every record was extracted.
Local authorities notified residents and suspended some services while they reviewed the incident. Yokohama City, for example, said its emergency information system had been stopped. People registered with these services should follow their municipality's notices and be cautious of unexpected messages that use local details to appear credible.
An outage that also affected local communications
The operator says all services were restored on October 15, about 105 hours after the intrusion began. ITmedia's timeline notes that a database password change also caused temporary problems for some customers, including failures in fire-information relays and automated phone calls.
Technical restoration does not mean every municipality immediately resumed all uses. Residents should check notices from local authorities and know alternative ways to receive weather, evacuation or safety information when the usual channel is unavailable.
Lessons for operators and municipalities
Arcadia says it blocked the identified access route, reviewed its services and planned external security testing and a specialist investigation. Its account also describes rotating secrets and considering stronger authentication. These are Arcadia's response measures; they do not replace reviews of customer-side accounts and systems.
For public-service operators, this case highlights the need to protect configuration files, separate secrets between services and prevent attachment servers from reaching internal resources. It also helps to prepare backup communication channels and ensure an emergency shutdown does not block information residents need.
The connection with Soclyde
Soclyde helps a team store and share human access secrets in an encrypted vault. This can organise a small team's passwords, but it does not protect service keys embedded in an application, fix a directory traversal flaw or guarantee the availability of an alert system.
Technical secrets need to be managed in the relevant development and operations environments, with appropriate rotation and monitoring. Explore Soclyde features for the scope of human credential management.
What to remember
The Arcadia incident involved a flaw on a file server, a recovered service key, potentially exposed data and a large send of fraudulent emails. The company says services have been restored, but it is still investigating the data involved. Subscribers should check local-authority notices and treat unexpected messages cautiously.
Organisations using service providers should review the secrets, permissions and backup procedures connected to those services. For team accounts, our small-business password policy guide complements technical work on the affected platforms.
