---
title: 'Arcadia forensic report confirms RAIDEN attack chain; 1,423,428 unauthorized emails sent'
url: 'https://securteksecurity.com/news/arcadia-forensic-report-confirms-raiden-attack-chain-1423428-emails'
markdown: 'https://securteksecurity.com/news/arcadia-forensic-report-confirms-raiden-attack-chain-1423428-emails.md'
date: '2026-10-19'
description: "Arcadia's detailed forensic report of October 19, 2026 confirms the attack chain behind the October 11 SpeeCAN RAIDEN incident in Japan. Attackers used a directory traversal flaw on a media server to read internal source files, took a service to service secret key from a configuration file, brute f…"
taxonomy:
  category:
    - Cybersecurity
---

# [Arcadia forensic report confirms RAIDEN attack chain; 1,423,428 unauthorized emails sent](https://securteksecurity.com/news/arcadia-forensic-report-confirms-raiden-attack-chain-1423428-emails)

   19th Oct 2026  

Arcadia's detailed forensic report of October 19, 2026 confirms the attack chain behind the October 11 SpeeCAN RAIDEN incident in Japan. Attackers used a directory traversal flaw on a media server to read internal source files, took a service to service secret key from a configuration file, brute forced account IDs and retrieved internal data through authenticated sessions, and a backdoor then sent 1,423,428 unauthorized emails through Arcadia's own system on October 12 to 13, many imitating a credit card company's balance check and sent from the genuine alert sender domain. Tampered records were found in one database, and services were restored on October 15.

Potential exposure remains an estimate in Arcadia's own terms: up to about 3.14 million email addresses, about 105,000 phone numbers and about 15,000 fax numbers across a service used by 875 municipalities. The NET119 exposure was narrowed on October 16 to data linked to 9,020 email addresses, with no sensitive health data confirmed leaked. Because the figures are company estimates of what may have been exposed rather than a confirmed taken count, no figure is added to the records exposed total.

Sources: [Japan Cyber Watch](https://japancyberwatch.com/articles/arcadia-speecan-raiden-disaster-alert-breach-2026); [Undercode News](https://undercodenews.com/japans-disaster-alert-email-provider-arcadia-confirms-142-million-unauthorized-emails-after-cyberattack-exposing-municipal-data-video/) (its headline figure of 142 million is an error in that headline; its body gives 1,423,428)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [APT28 Swallowtail espionage campaign targets defense firms and law enforcement in two NATO countries](https://securteksecurity.com/news/apt28-swallowtail-espionage-nato-defense-firms-hookedge.md)
- Next: [News Archive](https://securteksecurity.com/news/archive.md)