Arcadia's disaster-mail breach grew by about 343,000 more registrations across 17 more places in a single day, and the vendor still has no total of its own. I run AliasFleet, an email-alias service: one forwarding address per service, so a leak names its source. Our first article counted 85,425 across six slices on 13 October. The second wave, disclosed the same day, runs roughly four times that size. And the list is still growing.
Every number below means the same thing: data that may have leaked, not data confirmed as taken. No source has confirmed that anything was actually copied out. Keep that in mind.
The scam mail arrived before the confirmation did
The first article warned that scam mail would follow. It did not wait. In Yokosuka, the city confirmed that mail impersonating a card company had already reached addresses that may have leaked, asking recipients to confirm card usage details, per TV Asahi. The shape of the threat matters here. The message was not a forged disaster alert. It was about money, landing in an inbox the victim trusted for safety notices.
SBS reports that Kikugawa residents received forged billing mail sent from the mail domain itself. In Hikone, one resident reported unsolicited mail. Neither report proves the breach caused those messages. Billing scams arrive constantly with no breach behind them. But the timing fits the pattern, and both towns are treating the reports as warnings.
It proves the sender has the file, or a good guess at it. Verify through a channel you open yourself, never through a link inside the message.
Arcadia's ceiling, and the gap underneath it
Arcadia, based in Minoh City, Osaka, disclosed on 13 October that third-party unauthorised access hit its SpeeCAN RAIDEN disaster-mail service. Suspicious activity turned up on 11 October at about 16:30. Emergency measures blocked the intrusion route in the early hours of 12 October, and some services were emergency-stopped at 11:00 on 13 October, according to Kyodo.
The vendor's own figure is a maximum, not a victim count. Arcadia said up to about 3,136,000 email addresses may have leaked, plus up to about 105,000 phone numbers. An aggregator's account of Arcadia's official blog update, timed 18:47 on 13 October, adds up to about 15,000 FAX numbers to that maximum. That FAX figure comes from the aggregator, not from a primary source we could open directly. Treat it as reported, not confirmed.
Stack the municipal disclosures against that ceiling and the gap is the story. Both waves together come to about 428,000 disclosed slices. Large. Still a small fraction of 3,136,000. The rest is towns that have not disclosed counts, or have not finished checking.
Two vendor details widen the picture. The Raiden School service, which sends school and kindergarten notices, was emergency-stopped alongside the disaster-mail service, per Sanyo Shimbun. And the footprint is disputed: Sanyo reports Arcadia saying about 800 municipalities use the service, while Digital Agency materials cited by Asahi put adoption at about 700. Nobody has explained the difference.
The second-wave ledger
The towns reported separately, from separate registration bases. The sum is a sum of disclosed slices, not a vendor total and not a deduplicated headcount.
| Place | Disclosed slice | What may have leaked |
|---|---|---|
| Yokosuka City, Kanagawa | 58,920 (cumulative across four services) | Names, email addresses, phone numbers |
| Saga City, Saga | About 39,600 | Email addresses |
| Miyazaki Prefecture | 38,959 | Registered email addresses |
| Oita Prefecture | 37,936 (27,667 residents + 10,269 staff) | Resident emails; staff names, affiliations, staff numbers, emails |
| Oita City, Oita | 31,828 (28,201 + 3,627 staff) | City disaster-mail emails; staff names, affiliations, staff numbers, emails |
| Nagasaki City, Nagasaki | 28,432 | Email addresses |
| Hikone City, Shiga | About 26,000 | Citizen emails; staff and fire-brigade names, phones, emails; association and facility contacts |
| Yokote City, Akita | About 16,900 (cumulative) | Children's names and grades, parents' emails, staff names |
| Shimonoseki City, Yamaguchi | About 15,000 | Registered email addresses |
| Otsu City, Shiga | About 13,000 (11,000 citizens + 2,000 staff) | Citizen emails; staff names and emails |
| Okayama City, Okayama | About 9,850 (4,500 + 5,000 staff + 350 dam contacts) | Citizen and business emails; staff emails, phones, affiliations; dam-release contacts |
| Kikugawa City, Shizuoka (SBS) | 8,345 | Registered email addresses |
| Shimada City, Shizuoka | 7,583 | Email addresses |
| Tomiya City, Miyagi | 6,527 | Citizen email addresses, plus staff names and emails |
| Kakogawa City, Hyogo | About 2,000 staff | Staff names, personal email addresses, affiliations, staff numbers |
| Tokai City, Aichi | About 1,200 | Staff and medical-worker names, phones, related details |
| Waki Town, Yamaguchi | About 1,000 | Resident emails; staff names and emails |
Add the rows and you get 343,080, which rounds to about 343,000. Add the first wave's 85,425 and the disclosed total across both articles reaches 428,505, or about 428,000. Those sums mix emails, registrations, cumulative counts and staff records. They are not headcounts.
Named without counts so far: Akita City, Saitama City, Konan City, Kagawa Prefecture, Shimabara City, Kanazawa City, Tsuyama City and Tamano City. MRO reports Kanazawa is still confirming its count. A town that has not reported yet may still be checking. That is not the same as being safe.
One correction to an early figure. A number of about 16,000 attached to Akita City could not be verified in any source. It looks like a garbled version of Yokote City's ~16,900. Akita City disclosed a possible leak but no count, and it stays that way here.
Where this count can fool you
Oita Prefecture and Oita City run separate systems. Both slices belong in the ledger. But a resident could be registered in both, so the two must never be read as 69,764 separate people.
Yokosuka's 58,920 is cumulative across four services: disaster-info mail, fax, phone, and crime-prevention mail. One person can appear twice. Yokote's 16,900 works the same way, spanning school-contact mail and disaster mail. Cumulative counts measure registrations, not people.
Oita Prefecture said the server that was attacked differs from the server holding prefecture data, so actual outflow from its systems is unconfirmed, per OBS. That is a genuine uncertainty, not a dodge. "May have leaked" covers a wide range, from data exposed and copied to data merely within reach.
The first article carried its own version of this trap: Fukui City's 6,000 sits inside Fukui Prefecture's 34,800 and must never be added on top.
The school list is the one that worries me most
Yokote City's disclosure is the one to read most carefully. The at-risk registrations, about 16,900 cumulative, cover school-contact mail from primary and middle schools and after-school clubs to parents, plus the city's disaster mail. The data classes are children's names and grades, parents' emails, and staff names. Counts and data classes only. No child's details belong in any coverage of this story, and none appear here.
This slice matters because of the trust it rides on. A school-contact address is where a parent expects to hear about a bear sighting near the school, a closure, a change to pickup: a channel parents are trained not to ignore. A forged message there does not need to be sophisticated. It needs to sound like the school.
The Raiden School stop widens the point beyond one town. Arcadia emergency-stopped the school service alongside the disaster-mail service. Parents in affected areas should treat school mail with the same suspicion as town mail, and confirm any urgent school message through the school office directly.
One address per town service
The address on a disaster-mail list is usually the same address a resident uses for shopping, banking alerts, and newsletters. One vendor incident then exposes that address everywhere it was used. That is the reuse problem, and it is the part a resident can actually fix.
An email alias dedicated to a town service, forwarding to your real inbox, changes what the next disclosure means for you. The leaked address belongs to one service only. If that alias starts receiving bogus billing mail, the alias itself points to where the address came from, and it can be paused or replaced without changing the address used everywhere else. The leak-tracing mechanism works exactly this way, and the set-up guide takes about two minutes.
Two limits matter. An alias would not have stopped this intrusion, and nothing on the resident's side would have. And residents cannot pick a different disaster-alert vendor the way they pick a different shop. They register because their town tells them to, and they trust the channel because it carries safety information. When a scammer can imitate that trust, the protection has to sit with the resident: a separate address per service, plus a habit of verifying unexpected messages through official channels rather than through links inside the message.
If your town just joined the list
The towns issued the same practical warnings in different words. Gathered in one place:
- Expect impersonation mail. Treat any unexpected message claiming to be from your city, your child's school, a card company, or a local business as suspect until you verify it another way.
- Do not open links or attachments. Go to your town's official site directly, or call the town office on a number you already trust.
- Be wary of billing mail and card-verification mail especially. Yokosuka and Kikugawa are what the first wave looks like.
- Watch for password-reset mail you did not request. A leaked email address is the starting point for account takeover.
- Check whether your address has appeared in known breaches. Have I Been Pwned lets you check an address against its breach database, though this incident is too fresh to appear there yet. The breach-response order of operations covers the full sequence.
- Give each service its own alias going forward. If one alias later starts receiving suspicious mail, you will know which service it came from.
- Report suspicious mail to your town. Reports help towns warn other residents faster.
While delivery stays stopped, check disaster information through TV, radio, or official town sites instead of waiting for an alert email that may not arrive.
What nobody has answered yet
The disclosures leave large gaps. The intrusion vector is unknown. No source has named an attacker, reported confirmed exfiltration, a ransom or extortion demand, or a dataset surfacing publicly, or mentioned a report to Japan's Personal Information Protection Commission.
One claim needs its own flag. An Arcadia executive told Sanyo Shimbun the company may have faced an AI-driven attack. That is an unverified company suggestion, not a finding. No evidence has been published to support it. Wait for the investigation.
No readable screenshot of a municipal notice is included, because none was available at the drafting stage. The same limitation applied to the first article.
Towns that have not disclosed counts will report, and Arcadia may publish its own account with a consolidated total. Until then, the verified picture is narrow but clear: a second wave four times the size of the first, scam mail already arriving, and a vendor total that still does not exist.
Top comments (0)