A cyberattack on a Japanese emergency notification provider has exposed millions of residents to potential data theft and disrupted communications used to warn communities about natural disasters. The attackers also exploited the compromised service to distribute approximately 1.42 million suspicious emails.
The breach affected SpeeCAN RAIDEN, a disaster information distribution platform operated by Osaka-based technology company Arcadia. The service is used by 875 public organizations, including local governments and fire departments, as well as 242 businesses and 584 schools.
Arcadia detected unauthorized access on October 11, 2026. Its subsequent investigation found that attackers had gained access to systems responsible for distributing emergency notifications, potentially exposing approximately 3.13 million email addresses.
The compromised infrastructure was also used to distribute phishing messages on a massive scale. According to reports based on the company’s investigation, attackers sent more than 1.42 million suspicious emails, exploiting a communication channel normally associated with official disaster warnings.
Some fraudulent messages impersonated financial institutions and attempted to direct recipients toward suspicious websites. The emails were particularly deceptive because they appeared to originate from infrastructure associated with legitimate municipal emergency notifications.
The intrusion also disrupted essential public services. Arcadia temporarily suspended affected servers, preventing some municipalities from delivering their usual disaster-prevention emails. Local authorities were forced to rely on alternative communication methods while the systems were unavailable.
The potential data exposure extended beyond ordinary subscribers. Arcadia’s services also support emergency communications for fire departments and other public organizations, raising concerns about personal information stored across interconnected notification platforms.
Company representatives attributed the intrusion to automated attacks against authentication systems. Arcadia president Seiichi Tenpaku described the speed and volume of malicious activity as beyond what a human operator could reasonably perform manually.
Tenpaku suggested that artificial intelligence might have been involved, although investigators have not publicly presented evidence confirming the use of AI. Automated password attacks can also be conducted using conventional software tools.
Arcadia responded by restricting unauthorized access, shutting down affected infrastructure, and investigating the compromised systems. The company has issued updates to customers while working to determine the full extent of the incident.
The breach has been reported to Osaka Prefectural Police, who are investigating possible violations of Japan’s Unauthorized Access Prohibition Act. The identity of the attackers remains unknown.
The incident is particularly significant because emergency notification systems depend on public trust. When criminals gain access to infrastructure used for official warnings, fraudulent messages can appear more credible, while disruptions to legitimate alerts may interfere with important public safety communications.
Authorities have not confirmed that all potentially exposed email addresses were stolen. The investigation is continuing, and the final number of affected individuals has not been established.