S 22,519,960 recordsUnauthorized access by a third party exploiting the member information acquisition API occurred from October 9, 2026, and was detected and contained on October 13. There is a possibility that 22,519,960 records of member information were leaked externally, including email addresses, passwords, names, and addresses. It was not confirmed that all items were leaked for all registrants, and card information is not held by the target system.
Unauthorized access & data leakPossibleOfficial statement
S About 11,180,000 recordsUnauthorized access by a third party from October 2 to 7 confirmed an external leak of approximately 11,180,000 records of official app member information. The data included member IDs, email addresses, names, and phone numbers. No card numbers were held, and the leak of login passwords was unconfirmed.
Unauthorized access & data leakConfirmedOfficial statement
A 775,725 recordsUnauthorized access by a third party to the e-commerce site confirmed the external leakage of customer information, totaling 775,725 records. The data included contact information and hashed passwords. No leakage of addresses, delivery destinations, purchase history, or payment information was confirmed.
Unauthorized access & data leakConfirmedOfficial statement
A 155,280 recordsUnauthorized access occurred starting from the BI tool of the EC business support service CROS provided by ACCESS's consolidated subsidiary ACCESS AP TAIWAN, revealing external leakage of personal information related to 155,280 records of customer IDs and 231,998 records of order IDs. Card-related information involved a total of 1,671 cases, with 1,305 accounts after duplicate removal, and 11,441 unauthorized emails were confirmed separately. Customer IDs and order IDs have different units and cannot be combined, and as of now, no leakage of personal information related to other business partners has been confirmed.
Unauthorized access & data leakConfirmedOfficial statement
Yokosuka City "disaster prevention, crime prevention, fire information distribution"
B 47,065 peopleRelated to unauthorized access to Arcadia, it was announced that there is a possibility of leakage of registration information for disaster prevention and crime prevention emails, as well as registration information for distribution to firefighters and fire brigade members. Due to the impact within the city related to the same contractor incident, it is not treated as a separate attack. Up to 47,065 registrants in the largest category may have been exposed.
Kushiro City Board of Education (public school learning accounts)
B A cumulative total of 31,233 recordsA ransomware incident affected the internal server of contractor Portus. Account information belonging to students, teachers and other school personnel may have been exposed. The published figures total 31,233 cumulative records across the 2020, 2025 and 2026 academic years. The number of unique individuals is unknown because records may overlap across years. No actual data leakage or misuse had been confirmed.
B 25,775 peopleM3 confirmed exposure of some physician member and pharmaceutical-company employee information after unauthorized access to the MR-kun service. Fewer than ten percent of physician members and several hundred pharmaceutical representatives may be affected; precise totals are under investigation. Login passwords were excluded. According to news reports, 25,775 m3.com members and others were affected.
Unauthorized access & data leakConfirmedOfficial statement
Odawara City (disaster information notification services)
B About 21,600 recordsUnauthorized access to provider Arcadia's SpeeCAN RAIDEN system may have exposed registration information used by municipal notification services. The city reported approximately 21,600 disaster email records, 210 telephone notification records, 50 fax notification records, 270 heatstroke alert records and 1,100 staff email records. These categories are not a deduplicated count of individuals. The underlying incident overlaps with reports from Arcadia and other municipalities. Actual leakage had not been confirmed.
B Up to about 21,422 peopleKashiwa City stated on October 14, 2026 that unauthorized access to contractor Arcadia's SpeeCAN RAIDEN service could have exposed subscriber information in its public email alerts and staff mobilization system. The city's official report estimated 18,000 public alert subscribers (email addresses) and 3,422 registered municipal employees or related staff (names, email addresses and other details). Their combined upper-bound proxy of approximately 21,422 potentially affected people is derived from the two approximate registration populations; it is not a verified deduplicated victim count or a count of confirmed exfiltrated records. The public email service resumed on October 15, while information leakage had not been confirmed and investigation continued.
Unauthorized access & data leakPossibleOfficial statement
Kobo Co., Ltd. (Hassha Orai Net bus reservation service)
C Up to 8,341 recordsUnauthorized access to an API server used for bus reservation integration was detected on October 13, 2026. Evidence indicated that some reservation information had been exposed externally. Up to 8,341 records concerning 5,614 individuals may have been affected. These are preliminary upper-bound figures, not confirmed numbers of leaked records or individuals. The incident overlaps with notifications issued by bus operators using the same service.
Unauthorized access & data leakConfirmedOfficial statement
C About 2,200 recordsUnauthorized access to Arcadia resulted in the disclosure of approximately 2,200 records of registered information from the employee distribution system and a potential leak of NET119 registration information. The approximately 2,200 records pertain to employees and do not represent the total number of NET119 users.
Fukuoka City "evacuation information distribution system"
C 1,038 peopleFukuoka City announced that it cannot deny the possibility of a leak of registered user information related to unauthorized access to the mass information distribution service of the contractor Arcadia. The actual number of leaks has not been confirmed. Information on 1,038 registrants may have been leaked.
Karuizawa Town "disaster prevention radio telephone and fax service"
D 142 recordsUnauthorized access to Arcadia, operator of the SpeeCAN RAIDEN service used by the town, may have exposed 142 records containing subscriber names, telephone numbers and fax numbers for disaster prevention radio telephone and fax notifications. Actual leakage had not been confirmed.
Unauthorized access & data leakPossibleOfficial statement
E 17 recordsChina Bus reported unauthorized access from the operator of Hassha Oraline Net, leading to a potential leak of reservation information, which may also include reservations related to their own services. The operator has isolated the server and is investigating the extent of the impact. The affected reservation records number 17.
Fukuoka Prefecture "disaster risk information distribution system"
Related to unauthorized access to Arcadia's SpeeCAN RAIDEN, the possibility of leakage of user email addresses and other information was announced. The extent of the impact is under investigation, and actual leakage has not been confirmed.
Unauthorized access to the SpeeCAN RAIDEN system may have resulted in the leakage of registered information. External intrusion has been confirmed, and the scope of the impact is under investigation. Distribution is currently suspended.
Unauthorized access related to Arcadia's network may have resulted in the leakage of some employee information registered in the staff assembly system. No information leakage regarding disaster prevention emails for citizens has been confirmed.
Unauthorized access to the contractor Arcadia was announced, indicating a potential leak of personal information. The scope of the impact is under investigation, and no information leakage has been confirmed at this time.
Unauthorized access to the medical institution service @link and patient application was confirmed, leading to the suspension of services from late night on October 14. Investigations are ongoing regarding the cause and extent of the impact. No information has been confirmed regarding the leakage of patient information or the number of affected individuals.
Unauthorized access & data leakConfirmedOfficial statement
Funabashi City Fire Department "NET119 Emergency Reporting System"
Due to unauthorized access to the contractor Arcadia, it was announced that personal information such as contact details registered in NET119 may have been leaked. The actual occurrence of the leak and the extent of its impact remain uncertain.
Uonuma City Fire Department disclosed a possible exposure of registrant information following unauthorized access to contractor Arcadia's emergency notification systems NET119 and 119RAIDEN. Whether information was taken and the number of affected people were not established in the notice.
Unauthorized access & data leakPossibleOfficial statement
Unauthorized access to contractor Arcadia's SpeeCAN RAIDEN may have exposed municipal staff registration information, including names and email addresses. Residents' personal information was not stored in that system. The disaster prevention app for residents also used a separate platform and was not affected.
Koganei City "safety and security email and related services"
Unauthorized access to contractor Arcadia's SpeeCAN RAIDEN may have exposed email addresses registered for the city's safety and security email service, names and contact details registered for emergency disaster telephone and fax notifications, and names and contact details in the fire brigade emergency contact system. The city resumed some notifications at 3 p.m. on October 15.
Yamatotakada City "disaster information email notification service"
Unauthorized access to operator Arcadia's SpeeCAN RAIDEN may have exposed subscribers' email addresses, names, telephone numbers and fax numbers in the city's disaster information service. The city-specific number of affected records and whether leakage actually occurred remained under investigation.
Unauthorized access & data leakPossibleOfficial statement
