Hackers hijacked a disaster-alert email service used by 875 Japanese public bodies and sent 1.42 million phishing emails through it, according to reports, while the operator says up to 3.1 million email addresses may have been leaked.
Security incident · Japan public-sector alert system
Hijacked disaster-alert service sends 1.42 million phishing emails
Attackers abused a platform used by 875 Japanese public bodies to distribute emergency information. The operator says up to 3.1 million email addresses may have been leaked.
875
Public bodies using the affected service
1.42M
Phishing emails reportedly sent through the platform
3.1M
Email addresses that may have been leaked
Phishing emails vs. addresses that may be exposed
Both figures are email counts, drawn to the same scale. Column height is proportional to the value.
1.42M
Phishing emails sent
3.1M
Addresses possibly leaked
Takeaway: The leaked address pool is roughly twice the size of the phishing volume reported so far, so follow-on scams could outlast the campaign itself.
How the abuse chain works (as reported)
1. Access
Method not disclosed
→
2. Hijack
Platform used to send mail
→
3. Trusted look
Arrives via an official channel
→
4. Harm
Credential or data theft attempts
The AI question
"Not humanly possible": the CEO's claim is unverified
Arcadia's CEO suggests the speed and volume point to automation and possibly AI.
Independent verification has not been published, and the attackers' tools are unknown.
Security observers caution that attack speed alone does not confirm AI involvement.
Generative tools could still lower the cost of convincing phishing text and automated intrusion attempts.
What is known
Phishing was sent through a legitimate public-sector platform.
Osaka police are investigating the incident.
The operator has confirmed a compromise of its systems.
What remains open
How attackers gained access.
Whether leaked addresses have been or will be exploited.
Which public bodies were affected.
Why it matters
Phishing that arrives through an official government or emergency channel is more likely to be opened, which raises the stakes for recipients. The incident is likely to renew scrutiny of security requirements for shared public-sector communication platforms in Japan.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...