Japan alert-mail service SpeeCAN RAIDEN breached, sent 1.4m phishing emails

Japan alert-mail service SpeeCAN RAIDEN breached, sent 1.4m phishing emails

23 October 2026: Arcadia, a company in Minoh, Osaka, whose SpeeCAN RAIDEN service sends alert mail to registered subscribers on behalf of its customers, says an intruder planted a program that used its systems to send 1,423,428 phishing emails and may have taken contact data on as many as 3.1 million email addresses. The breach spread to NET119, an emergency reporting service, and to 119RAIDEN.

Not yet independently verified. Arcadia has not said how the attacker got in, and its figures are estimates it describes as still under investigation. A Taiwanese report of police personnel records among the data is not in Arcadia's own notices. We will update this when it can be confirmed, and remove this note.

Two weeks of disclosures

Arcadia first saw suspicious activity in SpeeCAN RAIDEN at 16:30 on 11 October and closed the entry route at about 03:00 the next day. Between 01:17 and 07:16 on 13 October a malicious program sent the phishing run from its systems, impersonating real companies to lure recipients to fake sites. At least 869,575 of those messages went to addresses Arcadia does not hold, so its own customers' subscribers were only part of the target list. The company suspended the two services it identified as the way in (SpeeCAN RAIDEN on raiden3.ktaiwork.jp and the Raiden School service on s2.ktaiwork.jp) and blocked the attacking IP addresses.

On 14 October, while investigating, it found traces of intrusion into NET119 and 119RAIDEN. Its estimates of the data that may have leaked are:

• SpeeCAN RAIDEN and Raiden School: contact names, email addresses, phone and fax numbers, staff in charge, contract details and the text of stored messages; up to about 3,136,000 email addresses, 105,000 phone numbers and 15,000 fax numbers.
• NET119 and 119RAIDEN: for 9,020 users, name, date of birth, sex, address, phone, email and fax; across both services, about 13,000 records, 97,000 email addresses, 17,000 phone numbers and 400 fax numbers. Video calls to NET119 are not affected.

Payment card data is not handled by the service. An outside firm is checking the dark web for the data.

Reporting on customers' behalf

Under Japan's personal information law each customer would normally report to the Personal Information Protection Commission itself. Arcadia says it consulted the commission and is filing those reports on its customers' behalf, and it is doing the same for resellers' reports to the Ministry of Internal Affairs and Communications. It has also notified the police, its ISMS and Privacy Mark certification bodies and the regional communications and economy bureaus.

What customers of the service must change

Organisations that link SpeeCAN RAIDEN to LINE must reissue the channel secret in the LINE Developers console (for segment delivery, both the Messaging API and LINE Login secrets) and save the new values in RAIDEN; anyone sharing those credentials with another provider has to pass on the new ones. X and Facebook links must be re-authorised. Two-step login by emailed code is now required on the raiden and Raiden School hosts. Since 22 October the API that lets outside systems trigger messages is switched off, so alerts must be sent by hand from SpeeCAN RAIDEN until it returns; weather-alert links still work.

Our emergency notification software category lists 8 products.

Company profile on TrustList: Arcadia Inc.

Sources

• Arcadia: Response to unauthorised access (notice), 23 October 2026
• SpeeCAN RAIDEN official blog: Response to unauthorised access to our services (22nd update), 23 October 2026
• iThome: Japanese notification service provider breached, 23 October 2026