About 125,000 police staff records may have leaked via Arukadia unauthorized access
In short
Fukuoka prefectural police said on 20 October that data on about 11,000 officers and staff may have leaked after the system vendor Arukadia (アルカディア) was accessed without authorization. On 21 October the National Police Agency said personal information of police officers and staff at 20 prefectural police forces, put at about 125,000, may be affected, plus residents' email addresses at four forces. No misuse has been confirmed in Fukuoka.
Read the full story 2 min read
Fukuoka prefectural police said on 20 October that personal information on about 11,000 police officers and staff may have leaked. The data are names, affiliations and personal email addresses registered in a system used to confirm staff safety and summon them in disasters, according to the police as reported by several outlets. [ 1 , 7 , 8 , 9 ]
The cause is unauthorized access to Arukadia (アルカディア), an IT company in Minoh, Osaka Prefecture. Fukuoka police said Arukadia notified them by email on 13 October that information might have leaked. Mainichi reported that the police signed a contract with the company in 2020 for a system that automatically sends mass messages to staff for emergency summons. No misuse has been confirmed so far. The police told departments to use alternative means in a disaster and said there was currently no impact on operations. [ 7 , 8 , 9 ]
On 21 October, the National Police Agency told outlets that the leak reached much further. Jiji, Nikkei, Asahi and TBS reported that personal information of officers and staff at 20 prefectural police forces, put at about 125,000, may have leaked, including names and email addresses. Jiji and TBS describe the figure as people, while Nikkei and Asahi describe it as items. Jiji said most of the addresses appeared to be private mobile addresses, and that some forces, including Tochigi and Saitama, had also registered affiliation information. [ 12 , 17 , 19 , 20 ]
Four prefectural police forces also used Arukadia's service for crime-prevention information for residents and companies. Nikkei and Asahi reported about 16,000 residents' email addresses registered there, and the agency said none of the investigation information is confirmed to have leaked. Jiji said Kyoto and Fukuoka used both systems, and Asahi named Kyoto and Fukuoka among the four forces using the crime-prevention service. Asahi and Yomiuri put about 2,600 corporate phone numbers among the data; Jiji described 2,600 entries for companies and corporations. [ 12 , 17 , 20 , 21 ]
Nikkei and Yomiuri counted 22 prefectural police forces in total. Yomiuri put the total at about 140,000 items, of which about 125,000 were police staff data. Nikkei reported that Tochigi police received Arukadia's email on 13 October and stopped operating the system the same day, and that affiliation information for all staff may have leaked. The National Police Agency said it is confirming the facts. [ 17 , 21 ]
Fukuoka prefecture and other local governments had earlier said that email addresses of users receiving disaster information via Arukadia's service may have leaked. Yomiuri said the company has contracts with many local governments beyond the police. [ 1 , 21 ]
Why it matters
The incident has spread from local government disaster-information services to police forces in 22 prefectures, according to the National Police Agency as reported by several outlets. The agency said it is still confirming the facts and considering its response.
Key facts
- Arukadia (アルカディア), an IT company based in Minoh, Osaka Prefecture that runs services for local governments, was subject to unauthorized access. [ 1 , 7 , 8 , 12 , 17 ]
- Fukuoka prefectural police said on 20 October that names, affiliations and personal email addresses of about 11,000 officers and staff may have leaked. [ 7 , 8 , 9 ]
- Fukuoka police were told of the possible leak by Arukadia on 13 October. [ 6 , 7 , 8 , 9 ]
- The National Police Agency said on 21 October that personal information of officers and staff at 20 prefectural police forces, about 125,000 in number, may have leaked; Jiji and TBS count people, while Nikkei, Asahi and Yomiuri count items. [ 12 , 17 , 19 , 20 , 21 ]
- Email addresses of about 16,000 residents registered for crime-prevention mail at four prefectural police forces may also have leaked. [ 12 , 17 , 20 , 21 ]
- Yomiuri reported 22 prefectural police forces and about 140,000 items of personal information in total. [ 21 ]
- The National Police Agency said no leak of investigation information has been confirmed. [ 17 ]
Confirmed by several sources
- Fukuoka prefectural police said about 11,000 officers and staff may have had names, affiliations and personal email addresses leaked, with no misuse confirmed so far. [ 7 , 8 , 9 ]
- Arukadia contacted Fukuoka police on 13 October about the possible leak. [ 6 , 7 , 8 , 9 ]
- According to the National Police Agency, personal information of officers and staff at 20 prefectural police forces, about 125,000 in number, may have leaked. [ 12 , 17 , 18 , 19 , 20 ]
- According to the National Police Agency, about 16,000 residents' email addresses registered with four prefectural police forces may also have leaked. [ 12 , 17 , 20 , 21 ]
- Fukuoka police told departments to use alternative means in a disaster and said there was no impact on operations at present. [ 7 , 9 ]
Still unclear
- Whether the figure of about 125,000 counts people or items. Jiji and TBS write about 125,000 people's worth of information, Nikkei, Asahi and Yomiuri write about 125,000 items, and NHK writes more than 120,000 items.
- How many prefectural police forces are affected. Headlines and some articles say 20 forces for the officer data and 22 forces overall; Jiji and Asahi say Kyoto and Fukuoka used both systems, while Nikkei and Yomiuri give 22 in total.
- What was registered for the roughly 2,600 corporate entries. Asahi and Yomiuri describe about 2,600 corporate phone numbers; Jiji describes 2,600 entries for companies and corporations and says more than 18,000 email addresses of citizens and companies may have leaked.
- The final scale of the leak. The National Police Agency said it is still confirming the facts, and the figures are described as possible leaks, not confirmed ones.
What local media are saying
Timeline, local time
- On 20 October TBS NEWS DIG reported that personal information of about 11,000 Fukuoka police officers and staff may have leaked. [ 1 ]
- On 20 October Sankei reported Fukuoka police's statement that the system vendor Arukadia had been accessed without authorization. [ 7 ]
- On 21 October Jiji reported, citing the National Police Agency, about 125,000 people's worth of officer and staff information at 20 prefectural police forces. [ 12 ]
- On 21 October NHK reported that more than 120,000 items at 20 police headquarters may have leaked. [ 18 ]
- On 22 October Yomiuri reported about 140,000 items of personal information in total at 22 prefectural police forces. [ 21 ]