October 21, 2026: Japan's National Police Agency (NPA) said that unauthorised access to cloud service operator Arcadia Inc. had exposed the names and email addresses of about 125,000 police officers and staff across prefectural forces. The agency says the information "may have been compromised". Canonical: national-police-agency-arcadia2026. Primary sources: Japan Times and Nippon.com (Jiji).
Police staff directories are a useful target for social engineering. A list of officers' names and work email addresses lets a fraudster write a message that looks like it came from inside the force, which is why this incident matters beyond the officers themselves.
What happened
- Mid-October 2026: an earlier Arcadia-linked incident, recorded as arcadia-speecan-raiden2026, was reported. It is not confirmed whether this is the same intrusion.
- October 21, 2026: NPA officials disclosed that unauthorised access to Arcadia had exposed police data.
The date of the access itself has not been stated. The catalog uses the disclosure date. Reports also differ on how many forces were affected: 20 in the Japan Times and Jiji coverage, and 22 in Kyodo and Bernama coverage.
What data was exposed
- Staff safety-check system: names and email addresses of officers and staff at 20 prefectural police forces. At some forces, the organisational unit was also exposed. The examples given are Tochigi and Saitama.
- Security-alert system: names and email addresses of about 16,000 individuals and 2,600 companies, used by four forces.
The catalog records the approximate figure of 125,000 as reported. The second group is recipients of police security alerts, so it includes people outside the force.
Technical analysis
The NPA has not published the attacker, the method, or whether any data was encrypted. The incident involved a cloud service operator rather than the police network itself, so the supply-chain pattern is the same as in other vendor breaches. This article does not speculate on the method.
Verified vs unverified
- Verified (NPA officials, as reported): unauthorised access to Arcadia, the two affected systems, and the categories of names and email addresses.
- Reported but not confirmed: the number of forces (20 or 22) and the approximate counts for the alert system.
- Not known: the attacker, the access date, whether the data has been published, and whether the earlier Arcadia incident is the same intrusion.
Who is at risk
- Police officers and staff on the listed systems, who may be targeted with messages that appear to come from colleagues or the force.
- Companies on the security-alert list, who may receive messages that imitate police alerts.
- The public, who may see scam messages that cite police alerts or investigations.
What to do
- Officers and staff: report suspicious messages to your organisation's security team, and do not open attachments from unexpected senders, even if they appear to be from inside the force.
- Turn on two-factor authentication for work and personal email accounts, and change any password you reuse elsewhere.
- Companies and individuals on alert lists: verify any police-branded message through the agency's official channels before acting on it, and do not reply to a link in the message.
- Be wary of any request for payment, identity numbers or passwords that arrives by email or text, whatever the sender claims to be.
- Keep any suspicious message, with its headers, before deleting it, and report it to your security team or to the agency. The record helps the people investigating.
Why a staff list is useful to attackers
A list of names and work email addresses is a map of who to impersonate. An attacker who knows that a particular officer works in a particular unit can write to that officer about a case, a training notice or a payment, and the message can look routine. The risk is not limited to the people on the list: a message that uses a real officer's name is harder for a colleague to question. The same logic applies to the alert recipients, who are used to acting on police messages and may therefore respond more quickly.
What the agency has not said
The NPA has not described the access date or the attacker, and it has not said whether the data has been published. It has also not said whether individuals will be notified directly, or whether the affected forces have changed the systems involved. Until those details are published, the figure of about 125,000 should be treated as the agency's approximate count, not a final one. The two systems may overlap, so the figure is not a count of unique people.
Related reading
For another case where police contact data was exposed and used for phishing, see the UK police contacts breach. For a Japanese email exposure with a similar phishing risk, see the Tokyo Metro email leak.