---
title: Japan's SpeeCAN RAIDEN alert-mail service was hacked and used to send 1,423,428 phishing-style emails from real municipal sender domains | ctxsec
url: https://ctxsec.com/items/arcadia-speecan-raiden-1-42m-phishing-emails
description: ""
status: "confirmed (Arcadia report, Shizuoka City notice)"
published: 2026-10-19
---

> 

[← Cybersecurity News](/news) · [markdown](/items/arcadia-speecan-raiden-1-42m-phishing-emails.md)

confirmed (Arcadia report, Shizuoka City notice)

2026-10-19

### Japan's SpeeCAN RAIDEN alert-mail service was hacked and used to send 1,423,428 phishing-style emails from real municipal sender domains

Arcadia Inc. (Osaka) runs SpeeCAN RAIDEN, a registration-based mail service that many Japanese municipalities use for disaster and safety alerts. On Oct 19 it published a timeline of the intrusion it first disclosed on Oct 13. On Oct 11 (Japan time) the attacker probed the service for hours, then used a directory path traversal on the media server that hosts attachments to pull internal source files, including config.ini, which held a secret key used for service-to-service logins. With that key they brute-forced account IDs and pulled internal data from the sessions. Arcadia blocked the entry path at about 3 AM on Oct 12. Early on Oct 13 a backdoor started sending mail, beginning with small batches and reaching 1,000 at a time, until Arcadia stopped it at 7:16 AM. Arcadia now counts 1,423,428 outbound emails, mostly fake credit-card 'usage confirmation' messages it suspects were phishing. Arcadia also found a WordPress plugin had been added and that records in one database had been altered; it fixed those by hand. All services were back by Oct 15. Possible exposure is still being investigated. Arcadia's first estimate for SpeeCAN RAIDEN was up to about 3.14 million email addresses. For NET119, the text-based 119 emergency service for people who can't use voice calls, it has now confirmed personal data linked to 9,020 email addresses. Shizuoka City says registrant addresses for its disaster-prevention mail (34,336 residents) and the names, staff numbers and departments of 6,915 city employees leaked. It warns that the fake card emails came from the real @raiden.ktaiwork.jp sender and should be deleted, not blocked, so residents still receive genuine alerts. Arcadia has reported to the Personal Information Protection Commission and other regulators, and plans to file a police damage report. Lesson: alert-mail senders pass SPF/DKIM checks, so a compromised alert platform is an ideal phishing launcher.

Sources: [Arcadia: incident timeline and response (PDF, Oct 19)](https://raiden.site.ktaiwork.jp/wp-content/uploads/sites/2/2026/10/2026_10_19AccessIncident.pdf) · [SpeeCAN RAIDEN official blog (updated Oct 19)](https://raiden.site.ktaiwork.jp/archives/4597) · [Shizuoka City disaster-mail notice](https://www.city.shizuoka.lg.jp/s4268/s000347.html) · [DailyDarkWeb summary (X)](https://x.com/DailyDarkWeb/status/2112147063786164327)