Japan disaster-alert service breach may expose 3.136 million email addresses
In short
Japan's Arukadia (アルカディア) said unauthorised access may have exposed up to about 3.136 million email addresses and 105,000 telephone numbers in its municipal alert services. Some services were suspended, and on October 14 the Fire and Disaster Management Agency asked municipalities to ensure they had alternative ways to reach residents during disasters.
Read the full story 1 min read
Unauthorised access to a Japanese municipal-alert service operator may have exposed up to about 3.136 million email addresses and 105,000 telephone numbers, the company announced on October 13. Arukadia (アルカディア), based in Minoh, Osaka Prefecture, suspended some services and began investigating after blocking the intrusion route. [ 2 , 9 ]
On October 14, the Fire and Disaster Management Agency asked municipalities to ensure they could transmit information to residents during disasters. Its notice asked authorities whose alert-distribution services were suspended to check whether they could use other means, such as disaster-management administrative radio systems. [ 36 ]
Okayama said on its website that the suspension prevented it from distributing disaster-alert emails and making telephone notifications about dam releases. Other affected authorities identified in reports included Tomiya, Shiso and Oita Prefecture. Okayama warned recipients not to open attachments or links in suspicious emails. [ 2 , 9 ]
ITmedia reported that potentially exposed information also included up to about 15,000 fax numbers, contact names and message text stored in distribution histories. Citing the company's announcement, it said suspicious activity was detected at 16:30 on October 11, emergency measures were taken around 03:00 on October 12, and some SpeeCAN RAIDEN environments were stopped at 11:00 on October 13. The company also suspended some environments of its school-email service. [ 16 ]
Responses varied by municipality. Matsumoto said its disaster-email service, with about 24,000 registrations, continued operating after the provider said it could be used. Nagasaki and Sasebo warned of possible email-address leakage but said it was not yet known whether personal information had actually been exposed. Both warned residents about suspicious messages. [ 7 , 8 ]
Reports on October 14 continued to describe possible exposure in municipalities across Japan. TBS reported that the company was investigating whether information had leaked and the extent of any leak, including possible effects on Fukushima, Koriyama, Tanagura and Kitashiobara. [ 26 ]
Why it matters
Service suspensions disrupted disaster-alert emails and dam-release telephone notifications in Okayama. Municipalities warned residents about suspicious emails, while the actual extent of information leakage remained under investigation.
Key facts
- Arukadia said up to about 3.136 million email addresses and 105,000 telephone numbers may have leaked. [ 2 , 9 , 16 ]
- The company detected suspicious activity on October 11 and suspended some services from 11:00 on October 13. [ 2 , 9 , 16 ]
- ITmedia reported that fax numbers, contact names and stored message text may also have leaked. [ 16 ]
- Okayama said it could not send disaster-alert emails or dam-release telephone notifications during the suspension. [ 2 , 9 ]
- On October 14 the Fire and Disaster Management Agency asked municipalities to secure alternative disaster-information channels. [ 36 ]
Confirmed by several sources
Still unclear
- Whether registered information was actually leaked, and the full extent of any leak, remain under investigation. The company and municipalities describe possible exposure rather than a fully established leak.
What local media are saying
Timeline, local time
- October 11: the company detects suspicious activity, according to ITmedia. [ 16 ]
- October 12: the company takes emergency measures to block the intrusion route, according to ITmedia. [ 16 ]
- October 13: some service environments are suspended. [ 2 , 9 , 16 ]
- October 14: Jiji Press reports the request for municipalities to secure alternative alert channels. [ 36 ]