Saitama police say data on about 13,000 staff may have leaked in vendor breach
In short
Saitama prefectural police said on 19 October that the names, affiliations and private email addresses of about 13,000 officers and staff may have leaked from a disaster safety-confirmation system. The cause was unauthorised access to Arcadia, the Osaka-based company that operates the system. On 20 October, Tochigi police said about 3,900 of their staff may also be affected.
Read the full story 2 min read
Saitama prefectural police said on 19 October that information on about 13,000 police officers and staff may have leaked from a system used to confirm their safety during disasters. The registered names, affiliations and private email addresses of everyone in the system may have been exposed. The police said the cause was unauthorised access to Arcadia (アルカディア), the Minoh, Osaka Prefecture company that operates the system under contract. TBS reported that no information on people outside the police was included. [ 1 , 2 , 3 , 4 , 5 ]
According to the police, Arcadia notified them by email on 13 October that information may have leaked because of the unauthorised access. The police said no misuse of the information had been confirmed so far. [ 1 , 2 , 3 , 5 ]
Nikkei reported on 19 October that Arcadia, which provides disaster information delivery services for local governments, had published measures to prevent a recurrence. The company said the breach exploited a vulnerability in a server that publishes attachments. The attacker is believed to have obtained authentication information, entered the system and extracted internal information. Arcadia detected abnormal load on a database on 11 October and blocked the entry route on 12 October. It then stopped part of the affected services as an emergency step and restored all services on 15 October. It is still investigating which personal information may have leaked. [ 6 ]
Arcadia has reviewed how its databases are accessed and set separate passwords for each service. It plans an outside vulnerability assessment and two-step authentication, and is considering a security operations centre to monitor cyberattacks. [ 6 ]
On 20 October, Mainichi reported, citing Tochigi police, that information on all of their roughly 3,900 staff may have leaked. The police security section said the service sends mass emails to staff in disasters to confirm their safety. The data that may have leaked includes names, affiliations, job titles, mobile phone numbers and email addresses, some of which are private. Arcadia contacted the police on 13 October, and they stopped the system the same day. Mainichi added that Kanuma and Nasukarasuyama in Tochigi Prefecture, which use Arcadia's information delivery service, have suspended email services for residents. TBS reported on 20 October that Kanagawa police and others may also have had staff information leaked. [ 7 , 8 ]
Why it matters
The case shows a breach at one service provider reaching the staff data of more than one police force. Local governments in Tochigi have also suspended resident email services that use Arcadia, and Mainichi says the impact is spreading.
Key facts
- Saitama police said on 19 October that data on about 13,000 officers and staff in a disaster safety-confirmation system may have leaked. [ 1 , 2 , 3 , 4 , 5 ]
- The data includes names, affiliations and private email addresses. [ 1 , 2 , 3 , 4 , 5 ]
- The cause was unauthorised access to Arcadia (Minoh, Osaka Prefecture), which operates the system under contract. [ 1 , 2 , 3 , 4 , 5 ]
- Arcadia told the police by email on 13 October that information may have leaked; no misuse has been confirmed. [ 1 , 2 , 3 , 5 ]
- Tochigi police said on 20 October that information on all of their roughly 3,900 staff may have leaked. [ 7 ]
- TBS reported that Kanagawa police and others may also be affected. [ 8 ]
Confirmed by several sources
- Saitama police said information on about 13,000 officers and staff may have leaked, including names, affiliations and private email addresses. [ 1 , 2 , 3 , 4 , 5 ]
- Arcadia, which operates the system for the police, suffered unauthorised access, and Saitama police were told on 13 October. [ 1 , 2 , 3 , 5 ]
- No misuse of the information had been confirmed as of the 19 October reports. [ 1 , 2 , 3 , 4 , 5 ]
- Tochigi police staff data may also have leaked through Arcadia's service. [ 7 , 8 ]
Still unclear
- The full range of personal information that may have leaked from Arcadia. Nikkei says Arcadia is still investigating the scope.
- How many police forces beyond Saitama and Tochigi are affected, and the details for Kanagawa. Only a TBS summary mentions Kanagawa and others, without figures.
- How the attacker got in. Nikkei says an attacker is believed to have obtained authentication information through a server vulnerability; this is a single-source account.
What local media are saying
Timeline, local time
- Kyodo's report of Saitama police disclosing the possible leak is stamped 19 October. [ 2 ]
- Nikkei's report on Arcadia's recurrence-prevention measures is published on 19 October. [ 6 ]
- Mainichi reports on 20 October that Tochigi police staff data may have leaked. [ 7 ]
- TBS reports on 20 October that Kanagawa and Tochigi police and others may be affected. [ 8 ]