The Alert Was Fake. The Danger Was Real.

Imagine the alert on your phone telling you a disaster is coming. You trust it instantly — that is the whole point of a disaster alert system. Now imagine the alert itself is the attack. That is what happened in Japan, where hackers broke into a disaster alert service used by hundreds of local governments and turned it into a phishing machine that sent 1.42 million suspicious emails.

The service belongs to Arcadia, an Osaka-based company that runs a disaster information distribution system for 875 Japanese public organizations, including local governments and fire departments. Another 242 companies and 584 schools use it too. Arcadia detected the unauthorized access on October 11, and the company says the attackers may have exposed roughly 3.13 million email addresses — the mailing list the service uses to warn residents about emergencies.

That list is what made the breach so dangerous. With the service’s own infrastructure in hand, the attackers did not need to fake a sender address or build a lookalike website. They sent their messages through the real system, the one residents are trained to trust without a second thought. Arcadia says about 1.42 million suspicious emails went out before the intrusion was contained.

How the attackers got in

Arcadia says the attackers likely used automated password guessing — trying passwords over and over until one worked. The company’s president, Seiichi Tenpaku, described the scale and speed of the attack as beyond what a human attacker could realistically manage, and suggested artificial intelligence may have been involved. The company has reported the incident to the Osaka Prefectural Police, who are investigating a possible violation of Japan’s Unauthorized Access Prohibition Act.

The breach also disrupted the service itself. Arcadia shut down some servers in response, which interrupted the delivery of disaster-prevention emails from local governments. A system built to warn people about earthquakes, floods, and fires went quiet while the people running it dealt with the intrusion.

Why this one matters

Disaster alerts sit in a special category of trust. When your phone screams about an earthquake or a tsunami, you do not stop to check the sender’s domain. You act. That is exactly why the system was such a valuable target: the attackers borrowed the credibility of a public safety service, and every message they sent arrived pre-trusted.

The incident is part of a rough run for Japan. In October, another major provider, SoftBank, was breached in an attack that disrupted infrastructure for 495 companies and local government services, including Japan’s largest railway operator, JR East, and its credit-card subsidiary View Card. The pattern is the same in both cases: attackers going after the shared services that everyone else depends on, because one compromise reaches hundreds of organizations at once.

It is also a reminder that the most dangerous phishing does not look like phishing. The messages in this attack came from a legitimate alert system, about a subject people are conditioned to obey. The usual red flags — a strange sender, a misspelled domain, a suspicious link — may not have been there at all.

What to do about it

If you receive an alert email that asks you to click a link or download something, stop. Real disaster alerts tell you what is happening and what to do; they do not need you to click through to find out. Go to the official website or app of your local government or emergency service directly, and check there.

For organizations that run alerting or mass-mailing services, the lessons are blunt. First, put strong, unique passwords and multi-factor authentication on every account that can send to your whole list — a single guessed password should never be enough to take over a system that reaches millions of people. Second, watch for automated login attempts: a flood of failed sign-ins is the signature of a password-guessing attack, and it should trigger a lockout or an alert long before the guesses succeed. Third, limit who can send: the account that composes alerts and the account that can push them to millions of addresses should not be the same account, and neither should be reachable from the open internet without extra checks.

And for everyone else, the habit that protects you here is the same one that protects you everywhere: when a trusted system gets abused, the trust itself becomes the weapon. Norad, Norway’s aid agency, learned the same lesson days ago, when 27 abused user accounts exposed the names and email addresses of 20,614 people. Verify the message through a second channel before you act on it — especially when the message is telling you to hurry.

The emails in this attack may already be in inboxes across Japan. The alert system is back under its owners’ control, but the exposed email addresses are still out there, and they are a ready-made target list for the next round of phishing. If you are on a Japanese disaster alert mailing list, expect suspicious mail and treat every unexpected alert email as guilty until proven innocent — even when it comes from a sender you trust, because attackers have now shown they can borrow that trust wholesale.