EXPLORINEER
en

JP — ITmedia

Tochigi Police May Have Leaked Data on All Staff; Arcadia Unauthorized Access Sees Other Prefectural Police Victims Emerge

Security1 min read

Police in Tochigi Prefecture may have leaked personal data of about 3,900 staff members. The leak is linked to a hacking attack on Arcadia, a company that sends disaster alerts, and other prefectural police forces have also reported possible leaks.

What happened

Arcadia, a company in Osaka that runs disaster information services, was hacked. Newspapers reported that the personal data of all Tochigi police staff, about 3,900 people, may have leaked. The data was used for a system that checks on people's safety during disasters. As of October 20, no misuse had been confirmed.

Key numbers

  • Tochigi: about 3,900 staff may be affected.
  • Kanagawa: about 16,000 of about 17,000 staff may be affected.
  • Saitama: about 13,000 staff records may be affected.
  • Aichi: about 15,000 records. Fukuoka: about 11,000 records.
  • Gunma: about 3,700. Hiroshima: about 5,700. Kagawa: about 2,400.

How the problem started

Arcadia found the hacking on October 11. Its mass-alert service, called SpeeCAN RAIDEN, was hit. More than 700 local governments in Japan use this service to send disaster emails. Some of them have stopped sending alerts or said their data may have leaked.

Why it matters

Police and local governments use these systems to warn people and check on them in emergencies. If the systems are not safe, staff privacy is at risk. It can also hurt trust in the services that keep people safe during disasters.

What to watch

  • Whether anyone misuses the leaked staff data.
  • How many more prefectural police and local governments report leaks.
  • What Arcadia finds about how the attackers got in and what it will do to fix the system.

Glossary

SpeeCAN RAIDEN
Arcadia's mass-alert service that sends one message to many people at once.
Security전자신문

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

SecurityVnExpress

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.

Security전자신문

Election Deepfakes Up 27% Worldwide; South Korea Ranks Third in Cumulative Cases

Reported AI-generated election deepfakes surged worldwide, with January to September 2026 cases already exceeding last year's full-year total by 27%, according to a Surfshark study. South Korea ranks third globally in cumulative cases with 16 since 2021, behind the United States and India. The study counted 235 cases across 46 countries from January 2020 to September 2026.