Japan's Disaster Alert System Was Hacked — and 1.42 Million Phishing Emails Came From an Address People Trust

There is exactly one email most people will open without thinking. It is not from their bank, their boss, or a shop they bought something from once. It is the one that tells them something dangerous is happening where they live — an earthquake warning, a flood evacuation, a fire two streets over. In Japan, where that kind of message is part of daily life, residents sign up for disaster alerts from their local government and then do the most sensible thing in the world: they trust whatever arrives from that sender, immediately, without checking.

On November 6, Cybernews reported that hackers had taken over the system behind those alerts and turned it into a phishing machine. The company that runs it, Osaka-based Arcadia, says about 3.13 million email addresses may have been exposed, and that the attackers sent 1.42 million suspicious emails through the compromised service. The messages went out from the same infrastructure that tells people when to run. That is the whole story, and it is worse than the numbers suggest, because the numbers are not the point. The trust is.

What happened, in the order it happened

Arcadia's disaster information distribution service is used by 875 Japanese public organizations — local governments and fire departments — along with 242 companies and 584 schools. It is the plumbing underneath the alerts that reach millions of residents. The company detected unauthorized access on October 11, 2026, and shut down some of its servers in response. That shutdown had a cost of its own: it disrupted the delivery of disaster-prevention emails from local governments while the incident was being handled.

The public disclosure came on November 6, nearly four weeks after the intrusion was found. By then the scale was clear. Roughly 3.13 million email addresses may have been exposed. Attackers had used the compromised service to send 1.42 million suspicious emails. Arcadia's president, Seiichi Tenpaku, apologized publicly for the damage to the company's reputation and the loss of public trust. He also said something that deserves more attention than it got: the attackers used brute force, and the scale and speed of it were beyond what a human attacker could realistically achieve. He suggested artificial intelligence may have been involved, describing the attack as "not humanly possible."

The company has reported the incident to the Osaka Prefectural Police. Authorities are investigating a suspected violation of Japan's Unauthorized Access Prohibition Act, and the investigation is still going on. What we do not yet know is as important as what we do: Arcadia has not said what the 1.42 million emails contained, which addresses actually received them, or how long the attackers held access before October 11. "May have been exposed" is doing a lot of work in that sentence, and until the investigation closes, the honest number for affected residents is "up to 3.13 million, exact figure unknown."

This is also not happening in isolation. Japan has had a rough autumn for infrastructure security. In October, SoftBank was breached in an incident that disrupted services for 495 companies and local government bodies, with Japan's largest railway operator, JR East, and its credit-card subsidiary View Card among those affected. The disaster-alert hack is the second time in a month that a system ordinary people rely on without thinking about it turned out to be reachable by attackers.

The number that matters is 3.13 million, not 1.42 million

Everyone will quote the 1.42 million emails, because it is the bigger, louder number — a million phishing messages, sent. But the sends are the noise. The list is the asset. A phishing campaign ends. A list of 3.13 million verified email addresses belonging to people who signed up for government alerts does not end. It gets sold, shared, and reused for years, and every future message sent to those addresses starts with an advantage most phishing lists never have: the recipient is a real person, at a real address, who has already demonstrated that they open official mail and act on it.

Think about what is actually on that list. These are not addresses scraped from a forum or bought from a data broker. They are people who registered with their city or their fire department to be told about danger. That registration tells an attacker three useful things at once: the address is active, the owner reads official mail, and the owner can be reached at a moment of fear. The next wave of mail to these addresses will not need to be clever. It can quote the recipient's city, their ward, the fact that they receive disaster alerts — details that make a message feel personal rather than random. That is how the Foundation case from the very same morning played out, and it is worth looking at, because it shows the second act of a breach like this.

Foundation, the company behind the Passport hardware wallet, disclosed its own breach on November 6. Attackers exploited a vulnerability in its self-hosted Cal.com scheduling software, then used a second flaw to steal service credentials and reach customer records, the email system, and domain settings. From there they attempted more than 23,000 phishing emails to 21,463 addresses — from Foundation's own legitimate email service. The exposed data included names, home addresses, phone numbers, order histories, and partial card details. And then the part that should make everyone uncomfortable: some customers reported receiving fraudulent phone calls from people impersonating Foundation support, who accurately quoted their order details and the last four digits of their card numbers while trying to talk them out of their wallet recovery phrases. The breach did not end when the emails stopped. It became a script for the next attack, delivered by someone who knew things only the company should have known.

That is what a list of 3.13 million disaster-alert subscribers becomes. Not one campaign, but raw material for every campaign that follows.

Three breaches, one morning

November 6 was not a single incident. It was a pattern, disclosed within hours of itself, and the pattern is what I want you to notice. Three different companies, three different sectors, one shared failure: the trusted sender was the thing that got compromised.

Incident	What was exposed	What the attackers sent
Arcadia disaster alerts (Japan)	~3.13 million email addresses	1.42 million suspicious emails through the alert service
Foundation hardware wallet	21,463 email addresses, plus names, home addresses, phone numbers, order histories, partial card details	23,000+ phishing emails from Foundation's own email service
Gnosis Pay cards	Customer information in the legacy card system (details per affected customer)	Breach notification emails to affected customers; users warned of follow-up phishing

Gnosis Pay, the third disclosure of the day, found unauthorized access on November 3 and told affected customers by email on November 6, adding mandatory 3D Secure checks on card payments until its consumer system closes on December 20. Its users immediately raised the same concern in the replies: the exposure of personal information means more fraudulent emails are coming, and the warnings will quote real details.

Three disclosures, one morning, one lesson. The sender you trust is not a guarantee. It is a target, and the more people trust it, the more valuable it is to take over.

A trusted sender is the whole attack

Here is why this kind of breach defeats every piece of advice people usually get about phishing. The standard checklist — check the sender, look for spelling mistakes, hover over the link — assumes the attacker is pretending to be someone else. When the attacker controls the real sending infrastructure, none of those checks fail. The mail genuinely comes from the real system. It passes SPF and DKIM, the authentication checks that spam filters rely on, because it is not spoofed. It is sent. The sender domain is correct, the branding is correct, and the reason to open it is the most legitimate reason an email can have: your local government may be telling you to leave your house.

That is the same shape as the story I wrote this morning about Claude Code sending users' email addresses to websites. Different mechanism, same shape: the leak did not come from a criminal pretending to be the tool. It came from inside the tool, through a feature working as designed. The Foundation breach is the same shape again: phishing mail that arrived from Foundation's real email service, followed by phone calls from people who knew the victims' order details. In each case, the victim's defenses were aimed at the wrong thing — at spotting a fake — while the real message came through the genuine channel.

I keep coming back to a simple rule, and this week has now proved it three times in one day: the question is not "does this email look real?" The question is "what would I do if this email were real, and can I verify it somewhere that is not this email?" If the answer to the second half is no, the email does not get a click, no matter how real it looks. A disaster alert that tells you to evacuate is also a message you can confirm on television, on the radio, on your city's official website, or on the alert app on your phone. If it only exists in your inbox, treat it as unverified until one of those other channels says the same thing.

"Not humanly possible" is the detail to sit with

Tenpaku's comment about the brute-force attack is the part of this story most coverage will skip, and it is the part that matters most for everyone who is not in Japan. He said the scale and speed were beyond what a human attacker could achieve, and raised the possibility that AI was involved. Read that as plainly as it was said: the guessing was done by machines, at a pace no person could match, against a system that held the email addresses of millions of people who trust their local government.

We keep defending infrastructure as though the attacker is a person sitting at a keyboard trying passwords one at a time. That attacker barely exists anymore. The guessing is automated, it runs around the clock, and it does not get tired or bored. A system that holds 3.13 million addresses and lets an automated process keep guessing until it gets in has a threat model that is about ten years out of date. I am not going to pretend I know Arcadia's exact setup — the investigation is still open, and the company has said only that brute force was involved. But the outcome tells you what you need to know: whatever stood between the internet and those addresses was something a machine could grind through.

The uncomfortable extension of this is that the same automated guessing is pointed at everything you use, every day. Your email provider, your bank, the shopping site that still lets you try passwords without a limit — all of them are being tested by machines, constantly. The difference between you and Arcadia is only scale. The fix is the same in both cases, and it is boring: stop letting a password be the only thing between an attacker and the account. Two-factor authentication, passkeys where they are offered, and a habit of assuming any password-only login is already a matter of time. I wrote about the recovery side of that bargain in the guide to temp email and two-factor authentication, because the second factor that dies with a lost inbox is the one that locks you out — the protection and the risk travel together, and you should choose them deliberately instead of discovering them by accident.

If a disaster alert lands in your inbox tonight

Advice is only useful if it is specific enough to follow while you are half-awake and slightly scared, which is exactly when these emails arrive. So here is the short version, in order.

Do not click a link inside an alert email. Open your browser and go to the official site yourself, or open the alert app on your phone. If the alert is real, it will be there. If it is only in your inbox, it is unverified, and unverified is the same as untrusted until proven otherwise.

Check the sender address character by character, not at a glance. The compromised mail in this incident came from the real system, so even this check would have passed — which is why it is second on the list, not first. Its real job is to catch the copycat wave that follows every breach like this one, because the copycats will use lookalike domains within days.

Expect the follow-up to quote real details about you. The Foundation victims got phone calls from people who knew their order histories and the last four digits of their cards. If you are on the Arcadia list, the follow-up may quote your city, your ward, or the fact that you receive disaster alerts. A message that knows something true about you is not automatically from someone you should trust. It may just mean your data was in the breach.

And if you received one of the 1.42 million, assume your address is now on a list that will be used again. That does not mean panic. It means you watch the inbox that address feeds for the next few months with more suspicion than usual, and you do not let that address be the one that guards your bank account, your password recovery, or your identity documents.

Give alert signups an address you can burn

This is the part of the story that belongs on this site, and I am going to say it plainly: the address you hand to a mailing list, an alert service, a newsletter, or a shop's checkout page should not be the address your life runs on. Not because every service will be breached — most will not — but because you cannot know in advance which one will be, and the cost of finding out is decided by which address you gave them.

The setup is simple. Open TempoMailUSA and copy the temporary address it gives you. Use that address for the alert signup, the newsletter, the trial, the one-off registration. The verification code lands in the temporary inbox, the service works, and your real address never enters their database. If that service is breached a year later, the address on the list is one you can abandon without losing anything. That is the whole argument I made in the comparison of disposable mail and Proton Mail: a throwaway address is not about hiding. It is about blast radius. A leak from an address you control for a single purpose is an annoyance. A leak from the address that holds your life together is an incident.

The boundary matters as much as the trick. A temporary inbox is for the signup, the trial, the alert feed. It is not for the account that holds your money, your work, or your recovery flows. If an alert service becomes something you depend on — real evacuation notices for your actual street — move it to a permanent address you control, and protect that address with two-factor authentication on a device you own. The tax brackets story from yesterday showed the same pattern from the other side: the IRS never emails you about a refund, and scammers ride every piece of real news to make their lures timely. Timely is not the same as true. The address you use is the one decision in that whole chain that is entirely yours, and it is the cheapest security decision you will ever make.

Frequently asked questions

Was my email address exposed in the Japan disaster alert breach? Possibly, if you signed up for disaster alerts from a Japanese local government, fire department, company, or school that uses Arcadia's service. Arcadia says about 3.13 million addresses "may have been exposed" — the exact figure is not confirmed, and the company has not published a list of affected organizations. If you receive alerts from a Japanese municipal service, assume your address could be on the list and watch for suspicious mail quoting real details about you.

What did the 1.42 million phishing emails contain? That has not been disclosed yet. Arcadia and the reporting so far describe them as "suspicious emails" sent through the compromised service. Until the investigation or the police release details, do not trust any summary of their content — including one that arrives in your inbox claiming to be that summary.

How did the attackers get in? Arcadia says the attackers used brute force, at a scale and speed its president described as beyond human capability, and raised the possibility that AI was involved. The investigation by the Osaka Prefectural Police is ongoing, and no further technical detail has been released. Treat any claim about the exact method as unconfirmed until the investigation says otherwise.

Is this the same kind of breach as the Foundation and Gnosis Pay disclosures? No — three separate incidents, disclosed on the same day. Foundation's breach came through a vulnerability in its self-hosted Cal.com scheduling software; Gnosis Pay found unauthorized access in its legacy card system on November 3. What they share is the pattern: a trusted sender was compromised, and the follow-up risk is phishing that quotes real personal details.

Should I stop signing up for disaster alerts? No. The alerts are genuinely useful, and in Japan they are part of how people stay safe. Change the address you sign up with, not the habit of signing up. Use a throwaway address for the feed, keep your real inbox for banking and recovery, and verify any urgent alert through a second channel — television, radio, the city's website, or the alert app — before you act on it.

Can a temp email address protect me from a breach like this? It limits the damage, which is the honest version of protection. If the address on the breached list is a temporary one, the attacker gets an inbox you can abandon, not the address tied to your bank, your password recovery, and your identity. It does not stop the breach, and it does not help if you need that inbox later for account recovery — which is why the boundary between trial addresses and permanent ones matters.

The sender is the target now

The lesson of November 6 is not that Japan got hacked. Countries and companies get hacked every week, and most of those stories fade by the weekend. The lesson is that the thing being hacked has changed. Attackers used to fake the sender. Now they take the sender — the disaster alert system, the hardware wallet's own email service, the coding tool's context, the event invitation from a company you admire. Each time, the victim's usual checks pass, because the checks were designed for a world where the forgery was the threat and the genuine channel was safe.

That world is gone. The genuine channel is the prize, because it arrives pre-trusted. So the check has to move. Not "does this look real" but "can I confirm this somewhere that is not this message." And the address you hand out has to move too — away from the inbox your life runs on, toward addresses you can burn when the next disclosure lands. Three breaches in one morning is not a coincidence. It is a schedule. Plan for the next one the way you would plan for weather: not by hoping it misses you, but by deciding in advance which parts of your life it is allowed to touch.