“This is not humanly possible”: Disaster alerts have been hijacked to send phishing messages

01 Hackers breached Arcadia’s disaster alert service, used by 875 Japanese public organizations.

02 Arcadia says 3.13 million email addresses may have been exposed.

03 Attackers sent 1.42 million suspicious emails through the compromised service.

04 Osaka police are investigating possible illegal access; Arcadia says automated password guessing may have powered the attack.

Key Takeaways by nexos.ai , reviewed by Cybernews staff.

Hackers have hijacked Japan’s disaster alert system to send millions of phishing emails.

Hackers broke into a disaster alert service used by 875 Japanese public organizations, turning a system designed to warn residents emergencies into a tool for mass phishing.

The disaster alert service plays a significant role in Japan's public safety infrastructure, as it is used by local governments and fire departments. Another 242 companies and 584 schools had also adopted the service.

Osaka-based Arcadia, the company operating the service, detected unauthorized access to its disaster information distribution service on October 11th, 2026.

The incident forced the company to shut down some servers, disrupting the delivery of disaster-prevention emails from local governments.

The attack may have exposed approximately 3.13 million email addresses and allowed attackers to send 1.42 million suspicious emails through the compromised infrastructure.

As reported by local media , Arcadia's president, Seiichi Tenpaku, addressed the incident, apologizing for the damage to the company's reputation and the loss of public trust.

The company said the attackers used brute force, noting that the scale and speed were beyond what a human attacker could realistically achieve.

Tenpaku suggested artificial intelligence may have been involved, describing the attack as "not humanly possible."

The company has reported the incident to the Osaka Prefectural Police. Authorities are investigating a suspected violation of Japan's Unauthorized Access Prohibition Act. The investigation is still ongoing.

Japan has been hit hard by cyberattacks. In October, another major provider, SoftBank, was breached , resulting in the country’s infrastructure being disrupted.

The breach affected 495 companies and local government services, with Japan’s largest railway operator, JR East, and its credit-card subsidiary View Card among them.