Identity · Privacy
Data breach may expose details of 125,000 Japanese police and staff
A cyberattack on Arcadia, a cloud provider, may have exposed names and email addresses of 125,000 police officers and staff in Japan, plus 18,000 public subscribers to crime alerts.
Ross GrantUpdated 2 min read
The short version
A company that helps Japanese police send emergency messages was hacked. The names and personal email addresses of 125,000 police officers and staff, plus over 18,000 people and businesses who signed up for crime alerts, might have been exposed. Police are checking if anyone has misused the data. So far, there is no sign the stolen information has been used for fraud.
By the numbers
- 125,000police officers and staff potentially affectedThe Japan Times
- 18,000+public subscribers to crime alerts potentially affectedThe Japan Times
What happened?
A cyberattack on Arcadia, a Japanese cloud service provider, may have exposed the names and personal email addresses of about 125,000 police officers and staff across 20 prefectural police forces. The breach also potentially affected over 18,000 members of the public and businesses who signed up for crime alerts. The National Police Agency has told police departments to alert those at risk and to find alternative ways to contact staff. No misuse of the data has been confirmed so far. This incident has only been reported by The Japan Times.
Who is affected
According to The Japan Times (opens in a new tab), the breach could affect about 125,000 officers and staff at 20 prefectural police forces across Japan. The affected police departments include those in Aichi, Hyogo, Hiroshima, Tochigi, Saitama, Shimane, Yamaguchi, Kyoto and Fukuoka prefectures. Four of these departments also used Arcadia to send crime alerts to residents and businesses.
More than 18,000 email addresses belonging to members of the public and businesses who signed up for crime alerts may also have been exposed. This includes about 16,000 individuals and over 2,600 companies or organisations.
What was taken
The information potentially exposed includes names and personal email addresses registered with Arcadia’s emergency communication system. Most of the email addresses are believed to be personal accounts used on private mobile phones. In some cases, information about which department an employee works in was also registered. For the crime alert system, names and email addresses of both individuals and organisations were included.
How the attack worked
The breach was the result of a cyberattack on Arcadia, a cloud service provider based in Minoh, Osaka Prefecture. Police departments had outsourced emergency communication and crime alert systems to Arcadia. These systems were designed to check on the safety of officers and staff during emergencies and to distribute alerts to the public. The Japan Times did not report technical details of how the attackers gained access or what vulnerabilities were exploited.
The response
No cases of the exposed information being used for fraud or other crimes have been confirmed so far, according to sources at the National Police Agency (NPA). The NPA has instructed the affected police departments to gather more information and to alert people to the risk of further harm. They have also been told to arrange alternative ways to contact personnel during emergencies. The incident has raised concerns about possible data breaches at other organisations that use Arcadia, such as local governments and fire departments.
So far, only The Japan Times has reported this breach. There is no confirmation from Arcadia or the NPA in a public statement. The exact method of the attack and whether any data has been misused remain unclear.
Why it matters
Sensitive information about police officers, staff, and members of the public could be at risk. If misused, this data could be used for targeted phishing or social engineering attacks. The breach also highlights the risks of outsourcing critical systems to third-party cloud providers.
Key points
- Names and personal email addresses of 125,000 police staff may be exposed.
- Over 18,000 public subscribers to crime alerts also affected.
- No evidence yet of the data being used for fraud or crime.
- Incident linked to a cyberattack on cloud provider Arcadia.
- Police instructed to alert those at risk and use alternative contact methods.
Sources
The Japan Times
Reference
