Disaster alert breach fuels phishing campaign in Japan

A disaster alert breach in Japan allowed attackers to send 1.42 million suspicious emails through a service used by public organizations, businesses and schools. Operator Arcadia detected unauthorized access on October 11, 2026, and said approximately 3.13 million email addresses may have been exposed.

Attackers exploit emergency communication service

Osaka-based Arcadia operates a disaster information distribution service that helps organizations communicate emergency warnings. Its customers include 875 Japanese public organizations, including local governments and fire departments. In addition, 242 companies and 584 schools had adopted the platform, giving the incident a potentially broad reach.

After discovering the intrusion, Arcadia shut down some servers. However, that response also disrupted disaster-prevention emails from local governments. The incident therefore affected both the security of subscriber information and the delivery of messages intended to keep residents informed.

Attackers used the compromised infrastructure to distribute suspicious emails through a service associated with emergency communications. Consequently, recipients faced phishing messages arriving through a channel they might normally trust. The reported figures describe possible email address exposure and suspicious messages sent, rather than a confirmed number of people who fell victim to phishing.

Disaster alert breach raises questions about automation

Arcadia said the attackers used brute-force techniques, which involve repeatedly trying passwords to gain access. According to the company, the volume and speed of those attempts exceeded what someone could realistically perform manually. However, that assessment alone does not establish which tools the attackers used.

Company president Seiichi Tenpaku suggested that artificial intelligence may have played a role. Nevertheless, the available account does not confirm AI involvement. Automated password-guessing tools can perform large numbers of attempts without someone entering each password individually, so automation and AI should not be treated as interchangeable explanations.

Tenpaku also apologized over the incident, acknowledging damage to Arcadia’s reputation and public trust. Meanwhile, the disruption highlighted the consequences of an intrusion affecting a service that supports local emergency communications.

Police investigate unauthorized access

Arcadia reported the incident to Osaka Prefectural Police. Authorities are investigating a suspected violation of Japan’s Unauthorized Access Prohibition Act, and the investigation remains ongoing.

For now, uncertainty remains over the full extent of the email address exposure and the attackers’ methods. Although Arcadia has provided estimates of the affected data and outgoing messages, those figures do not establish how many recipients opened the emails or disclosed information.