A Up to 817,215 peopleOn October 13, 2026, unauthorized access to member My Page by a third party was confirmed from logs. Up to 817,215 people may have been affected, with member information including names, addresses, phone numbers, and dates of birth being targeted. Measures to block unauthorized access have been implemented, and investigations and improvements are ongoing. It has not been confirmed that all individuals in the maximum target group were viewed.
Unauthorized access & data leakConfirmedOfficial statement
A Up to about 400,000 recordsOn October 14, 2026, it was officially announced that there was a possibility that email addresses and other information were leaked due to unauthorized access at IDC Frontier. It was not confirmed that a leak had occurred. According to news reports, up to about 400,000 records may have been leaked.
A 117,392 accountsUnauthorized login attempts to administrator accounts and evidence of member information viewing were confirmed from October 11 to 13. There is a possibility that information from 117,392 accounts was viewed across the two affected services. No data exfiltration or secondary damage has been confirmed, and payment information is excluded.
Unauthorized access & data leakPossibleOfficial statement
B Up to 98,256 peopleUnauthorized server intrusion and installation of malicious software capable of reading members' passwords were identified during the period from July 11 to October 12, 2026. Personal information concerning up to 98,256 members may have been exposed. Identity verification document images for up to 7,261 members are included within that figure. Up to 1,364 inquiry form submissions were reported separately. These figures do not represent confirmed numbers of affected individuals.
Unauthorized access & data leakPossibleOfficial statement
B 36,328 recordsArcadia, the operator of Toyokawa Anshin Mail, reported unauthorized access, indicating a possibility that personal information of registrants may have been leaked. However, there was no confirmation of actual leakage. 36,328 records may have been leaked.
B 33,336 peopleArcadia announced a potential data leak of registered information due to unauthorized access to the emergency information email system. The actual extent of the leak is under investigation. Up to 33,336 people may have been affected in the largest category.
Kobe City "staff information notification email system"
B About 13,000 peopleUnauthorized access to contractor Arcadia's SpeeCAN RAIDEN may have exposed names, staff numbers, departments and email addresses for approximately 13,000 people, including municipal staff, and telephone numbers for approximately 80 people. Actual external leakage had not been confirmed. Counts for the different categories should not be added together.
Tamano City "disaster prevention email newsletter (SpeeCAN RAIDEN)"
C 5,001 recordsThe city disclosed possible exposure of names and email addresses registered for its disaster prevention email newsletter after unauthorized access by a third party to disaster information provider Arcadia's SpeeCAN RAIDEN. There were 5,001 records of registrations. Actual leakage had not been established.
C About 1,940 peopleDue to unauthorized access to the contractor Commune, it was announced that the member information of DIGIFUL BASE, estimated to involve approximately 1,940 people, may have been viewed or obtained. The information includes email addresses and profiles, but the actual number of confirmed leaks is not known.
C 1,855 recordsUenohara City disclosed possible exposure of information registered in multiple municipal emergency alert and NET119 services after unauthorized access to provider Arcadia. The number of affected users and actual exfiltration were not confirmed. Up to 1,855 records may have been leaked in the largest category.
Unauthorized access & data leakPossibleOfficial statement
Mitaka City "emergency information distribution and staff mobilization email"
C Up to 1,240 recordsUnauthorized access to SpeeCAN RAIDEN may have exposed registration information in 22 records for resident emergency notifications, 12 records for facility fax notifications and 1,218 records for staff mobilization email. The 22 resident plus 1,218 staff personal records total 1,240 entries; the 12 facility fax records are excluded from this personal-record count. Whether leakage occurred remained under investigation. Affected-count basis: The principal potentially affected personal-registration datasets contain 22 resident telephone entries and 1,218 staff email entries, totaling up to 1,240 records. Twelve facility fax entries are separately reported but excluded from this personal-record proxy. Unique individuals and actual exfiltration are unconfirmed.
Unauthorized access & data leakPossibleOfficial statement
D 750 peopleUnauthorized access to the contractor Commune may have allowed viewing and acquisition of information for 750 people, including email addresses for 749 individuals. No secondary damage has been confirmed, and there was no impact on the main game or payment information.
Hashima City "email notification system for fire personnel and related parties"
D 493 recordsUnauthorized access to contractor Arcadia's 119 RAIDEN may have exposed 493 records of registration information: 90 for fire department employees, 387 for volunteer firefighters and 16 for related companies. Names, email addresses and other registered information were potentially affected. Actual leakage had not been confirmed.
Unauthorized access & data leakPossibleOfficial statement
D Up to 213 peopleNagoya City reported in its October 21, 2026 second notice that 184 Net119 subscriber records could have been exposed following a compromise of service provider Arcadia: 45 people in actual emergency-call records and 139 people in practice-call records. A further 29 fire department staff members were separately affected by potential exposure, for a combined upper-bound population of 213 people. This is not a confirmed number of victims whose data was actually exfiltrated, and the city reported no known secondary harm as of October 21.
Unauthorized access & data leakPossibleOfficial statement
F 7 peopleUnauthorized access to Arcadia's mass communication service may have resulted in the leakage of names, addresses, dates of birth, and phone numbers of 7 people. The city is explaining the situation to the affected individuals, and there is no confirmation of information disclosure or misuse.
Sakura City "disaster information telephone notification service"
F 3 peopleUnauthorized access to contractor Arcadia's SpeeCAN RAIDEN may have exposed information concerning 3 people registered for the city's disaster information telephone notification service. Actual leakage had not been confirmed and remained under investigation. The city's regular email notification service was not affected.
Unauthorized access & data leakPossibleOfficial statement
On October 14, 2026, Unirita confirmed in a third report that information from their company was included in data publicly disclosed regarding unauthorized access that was identified on September 28. They are currently analyzing the details and scope of the leaked information. This incident is separate from the damage to their community infrastructure contractor.
Unauthorized access & data leakConfirmedOfficial statement
Fukushima City "disaster prevention and disaster information newsletter"
Unauthorized access to Arcadia may have resulted in the leakage of registered email addresses for the disaster prevention and disaster information newsletter. No external disclosure or unauthorized use of the information has been confirmed at the time of the announcement.
Mino City "Mino disaster prevention and safety email"
The city disclosed possible exposure of registered email addresses for its disaster prevention and safety email service following unauthorized access by a third party to email delivery provider Arcadia. Actual leakage of subscriber information had not been confirmed, and the scope remained under investigation.
Takatsuki City "emergency and disaster information notification service"
The city disclosed possible exposure of registered personal information after unauthorized access to SpeeCAN RAIDEN, operated by Arcadia, the provider of its emergency and disaster information notification service. The city-specific affected count and whether leakage actually occurred had not been established. The provider was investigating the scope.
Maebashi City "Machi no Anzen Hiro Mail and related services"
Unauthorized access to contractor Arcadia's information distribution system may have exposed registration information for Machi no Anzen Hiro Mail, staff mobilization email, the elderly telephone notification service, 119RAIDEN and related services. The affected count and whether actual acquisition occurred were not disclosed.
