Arcadia's disaster-mail intrusion may have exposed residents' email addresses in towns across Japan, because one vendor ran the alert service for all of them. I run AliasFleet, an email-alias service that gives each service its own forwarding address, so a leak names its source. Residents signed up for safety alerts. Now the safety channel itself is the one they have to treat with suspicion.
Think about what that signup asked for. A resident gave their town an email address so the town could reach them when it mattered most: a flood warning, an evacuation order, a road closure. That address sat in a system the resident never saw, run by a company the resident never chose. When the intrusion came, the resident heard about it not from the vendor but from their own town, days later, in a notice that could confirm almost nothing.
Nothing in the disclosures so far says data was definitely taken. Every one of them says leakage is possible. That gap between possible and confirmed is where residents now live, and it is also where the scam mail will live. If an attacker holds a disaster-mail list, they hold a list of people who trust messages from their town. The warnings from the towns all point the same way: expect impersonation mail, and verify through another channel before trusting any of it.
One vendor, many towns, one intrusion
Arcadia sits in Minoh City, Osaka. It operates municipal disaster-information email and SNS delivery services, including SpeeCanRAIDEN. Towns across Japan used that shared service to send safety alerts to residents, so one intrusion into part of it reached beyond any single town's list.
The public timeline, as the municipal disclosures tell it, runs over three days:
| Date | What the disclosures say happened |
|---|---|
| 11 October | Suspicious activity suggesting third-party unauthorised access found at about 16:30 in part of Arcadia's service |
| 12 October | Arcadia applied emergency measures blocking the intrusion route |
| 13 October | Municipalities disclosed and stopped delivery |
Beyond that sequence, the public record goes quiet. No source has disclosed the intrusion vector. No source has named an attacker. No source has said how long access lasted before it was found. The structure is the part that is clear: a town running its own alert system limits an incident to its own registrants, while a vendor running the same system for many towns turns one intrusion into a multi-town incident.
One FNN report names Minoh, Arcadia's home city, alongside Shiso City in Hyogo and Konan City in Shiga as service users. Minoh's citizen safety mail and Hazardon app notices stopped with the rest. Counts for those towns have not been disclosed. The list of affected towns may still grow as Arcadia and other municipalities finish their checks.
The town-by-town picture
Read the figures below the way the sources phrase them: data that may have leaked, not data confirmed as taken. The towns reported separately, from separate registration bases, so their numbers do not combine into a vendor total. For transparency, the disclosed named slices add up to 85,425, which is best read as at least about 85,000 across the named slices. That sum is a total of disclosed per-municipality figures. It is not a vendor total, and it is not a deduplicated headcount. Several towns have not disclosed counts at all, so the true scope remains unknown.
Mima City, Tokushima: 328 people
Start small. The smallest slice is also the most specific: Mima City disclosed 328 people who used non-smartphone channels, phone, fax, or email. Names, phone numbers, fax numbers, and email addresses may have leaked for that group, and no confirmed leakage or harm had been reported so far. JRT reported the Mima disclosure.
Makinohara City, Shizuoka: about 2,700
Makinohara City disclosed about 2,700 email addresses from its Makinohara Tea Mail service. No confirmed misuse had been reported as of 17:00 on 13 October. The city warned about bogus billing mail. SBS reported the Makinohara disclosure.
That billing warning deserves attention. Scam mail after a leak rarely arrives labelled as a disaster alert. It more often arrives as an invoice, a delivery notice, or a payment reminder. A resident who expects a flood warning and gets a bill instead may not connect the two. The connection is the leaked address.
Ayase City, Kanagawa: about 11,000
Ayase City disclosed about 11,000 records: email addresses plus district or area. The service was emergency-stopped, and no confirmed misuse had been reported so far. KSB reported the Ayase disclosure, and TV Asahi carried the same city account.
District data may sound minor next to an email address. Paired with an address, though, it helps a scammer write a message that sounds local. A note that names your district feels like it came from someone nearby. That is the point of it.
Sasebo City, Nagasaki: about 11,800
Sasebo City disclosed about 11,800 records in total. The split is about 9,600 citizens' email addresses, from Sasebo disaster-info mail plus road-flooding mail, and about 2,200 staff records covering email addresses, names, affiliations, staff numbers, and some staff phone numbers. NCC reported the Sasebo disclosure. The city said no victim reports had arrived so far, and it warned residents about mail impersonating the city or local businesses.
Joetsu City, Niigata: 24,797 registrants
Joetsu City disclosed 24,797 registrants, a cumulative count, whose email addresses may have leaked. The disclosure also covers fire-brigade members' names and phone numbers, plus city staff names, staff numbers, and affiliations. The Joetsu Town Journal reported the city's disclosure.
Fire-brigade members sit in an awkward spot here. Their details were in the system because they respond to emergencies, and now the same incident puts their contact details at risk. A scammer who knows a volunteer's name and number can write a message that sounds like it came from inside the response network.
Fukui Prefecture: at least 34,800 registrants
The largest named slice comes from seven municipalities in Fukui Prefecture disclosing together: Fukui City, Awara, Ono, Echizen, Sabae, Ikeda town, and Tsuruga. At least 34,800 registrants may be affected, with email addresses plus municipal staff names at risk. FBC Fukui reported the joint disclosure, and the Fukui Shimbun carried the same prefecture-wide account.
One trap hides inside that figure. Fukui City alone accounts for about 6,000 of it: registrants' email addresses plus city staff email addresses plus staff names. FNN reported the Fukui City slice separately. That 6,000 sits inside the 34,800. It must never be added on top of it.
Towns still counting
Takaoka City in Toyama stopped service without disclosing a count yet. Tulip TV reported the Takaoka stop. Minoh City also stopped its citizen safety mail and Hazardon app notices without a disclosed count. Shiso City and Konan City are named as service users with no counts disclosed.
Silence from a town is not safety. It means the check is still running. Until those towns report, any total for this incident stays incomplete, and residents there should follow their town's official notices rather than assuming they were spared.
A separate address per service shrinks the damage
The address on a disaster-mail list is often the same address a resident uses for shopping, banking alerts, and newsletters. One supplier incident then exposes that address everywhere it was used. That is the reuse problem, and it is the part a resident can actually fix.
A separate alias per service changes the shape of the next incident. An email alias dedicated to disaster mail, forwarding to your real inbox, means the leaked address belongs to one service only. If that alias starts receiving bogus billing mail, the alias itself points to where the address came from, and that alias can be paused or replaced without changing the address used everywhere else. The leak-tracing mechanism works exactly this way, and the set-up guide takes about two minutes.
Two limits matter. First, an alias would not have stopped this intrusion. It would not have. Second, residents cannot choose a different disaster-alert vendor the way they can choose a different shop. They register because their town tells them to, and they trust the channel because it carries safety information. When a scammer can imitate that trust, the defence has to sit with the resident: a separate address per service, plus a habit of verifying unexpected messages through official channels rather than through links inside the message.
If your town is on this list
The towns issued the same practical warnings in different words. Here they are, gathered in one place:
- Expect impersonation mail. Treat any unexpected message claiming to be from your city, a local business, or a disaster service as suspect until you verify it another way.
- Do not open links or attachments in such messages. Go to your town's official site directly, or call the town office on a number you already trust.
- Be wary of billing mail in particular. Makinohara's warning about bogus billing mail is a reminder that scam mail after a leak rarely announces itself as a disaster alert.
- Watch for password-reset mail you did not request. A leaked email address is the starting point for account-takeover attempts.
- Check whether your address has appeared in known breaches. Have I Been Pwned lets you check an address against its breach database, though this incident is too fresh to appear there yet. The breach-response order of operations covers the full sequence.
- Give each service its own alias going forward. If one alias later starts receiving suspicious mail, you will know which service it came from, and you can pause or replace that alias alone.
- Report suspicious mail to your town. Reports help towns warn other residents faster.
While delivery stays stopped, check disaster information through TV, radio, or official town sites instead of waiting for an alert email that may not arrive.
Gaps the disclosures leave open
The disclosures leave large gaps, and a careful reader should hold them open rather than filling them in. The intrusion vector is unknown. The scope is still under investigation. Several towns have not disclosed counts. No source has reported confirmed exfiltration, confirmed misuse, or an attacker identity. No source has mentioned a report to Japan's Personal Information Protection Commission yet. Those gaps are normal at this stage of an incident, and they are also the reason every figure in this article stays hedged.
Two further limits apply to this article itself. First, the per-town figures come from press coverage of municipal disclosures, not from a single vendor statement with a consolidated count, so the article reports them separately and labels the summed figure as a sum of disclosed slices. Second, no real screenshot of a municipal notice is included, because none was available at the drafting stage.
The incident will move. Towns that have not disclosed counts will report, and Arcadia may publish its own account. For now, the verified picture is narrow but clear: one vendor, many towns, one intrusion, and a possibility of leakage that residents should take seriously without treating it as confirmed theft.
FAQ
Was my email address definitely leaked?
No source says so. Every disclosure so far says there is a possibility of leakage, not confirmed exfiltration. If you registered for disaster mail in one of the affected towns, treat your address as possibly exposed and follow the steps above.
Which towns are affected?
Named slices cover Fukui Prefecture with seven municipalities, Joetsu, Sasebo, Ayase, Makinohara, and Mima, plus towns such as Takaoka and Minoh where service stopped but counts have not been disclosed. FNN also names Shiso City and Konan City as service users. The list may grow as checks complete.
Is it safe to keep using disaster mail now?
Affected towns stopped delivery while they investigate. Follow your own town's notice for when service resumes, and in the meantime check disaster information through TV, radio, or official town sites.
What should I do if I get a suspicious message claiming to be from my city?
Do not open links or attachments. Go to your town's official site or contact the town office through a number you already trust, and report the message. A real town office will not ask you to log in or pay through a link in an unexpected message.
Top comments (0)