Part 7 of a series on Japan’s cybersecurity blind spot. Start with the overview, Japan cyberattacks in 2026: what the breach wave reveals, or read the previous part, Sovereign AI, made elsewhere.

Written on 16 October 2026, after JMA’s afternoon briefing. JMA had apologized but had not yet published a cause. I’ll update this article when it does.

At about 12:40 on Friday 16 October 2026, phones across eastern Japan screamed. An Earthquake Early Warning, relayed by J-Alert, announced a magnitude 9.9 earthquake off the Kuril Islands, with a predicted maximum intensity of 7 and strong shaking expected in 22 prefectures from Hokkaido to Aichi, Tokyo and Kanagawa included.

By 12:44, NHK said its cameras around the country showed no shaking. At 12:48 the warning was cancelled, and every phone screamed again to say so.

On X, plenty of people skipped “what happened?” and went straight to “were we hacked?” In one 36-second window around 13:00, I counted about two dozen posts asking whether the warning or J-Alert had been hacked or hijacked. Several tied it straight to this autumn’s breach wave.

So, was it hacked? Nothing in the public record points that way. The evidence points to a legitimate government system misfiring on a real, distant, deep earthquake. At an afternoon briefing, the head of JMA’s earthquake and tsunami monitoring division apologized for the trouble caused. As of the evening of 16 October, JMA hadn’t published a cause, and I’d seen no official statement on tampering either way.

And that’s the problem. Nobody needs to hack Japan’s alert systems to break them. The systems already teach people to doubt them, and six weeks of breaches have made “was it hacked?” the reflex.

What actually happened

Most of this comes from JMA’s own published data.

  • 12:35:32. USGS recorded an M6.9 earthquake 143 km deep, off southern Kamchatka.
  • 12:38:10. JMA’s system detected the waves. Its first 14 reports estimated M6.2 to M7.6, with a predicted maximum intensity of about 1 to 3 (JMA forecast record).
  • 12:39:23. Report 15, 73.5 seconds after detection, jumped to M9.9 at a fixed point 140 km deep.
  • 12:40:02. Report 17 crossed the threshold, and the public warning went out. The intensity 7 forecasts were for eastern Hokkaido. Tokyo’s 23 wards were forecast at 1 to 4.
  • 12:40 to 12:48. JMA kept issuing reports about every 20 seconds, all at M9.9, through report 42.
  • 12:48. Cancelled.
  • About 12:52. JMA’s earthquake information gave the real event: near Kamchatka, about 160 km deep, M6.9, maximum observed intensity 1 in Hokkaido, and no tsunami risk.

Even the first reports disagreed. Fuji TV wrote at 12:49 that, according to JMA, no earthquake had occurred. Minutes later, JMA’s own data described a real M6.9. Nippon TV reported that, according to people involved, the system may have mistaken it for a giant quake. JMA held a briefing that afternoon and apologized, but that evening its own pages still carried no explanation of the cause. The Japan Times reported the real quake was felt lightly in Hakodate.

Weathernews explains, in Japanese, how the warning overestimated a distant M6.9 and why it was cancelled. Video: なぜ？緊急地震速報発表が取り消しに？ 一時カムチャッカ半島付近でM9.9と過大予測　過去にもキャンセル報の事例あり from ウェザーニュース.

Why a misfire is the evidence-based reading

JMA publishes the system’s limits plainly. Warnings run on a few seconds of data, so they carry errors. The errors can be large for earthquakes more than about 100 km from the network, and the standard method can overestimate intensity for deep ones. The bigger the quake, the longer it takes to pin down the magnitude. Noise and faulty equipment can trigger false warnings.

This earthquake was distant, deep, and offshore: exactly the conditions JMA warns about. By my own calculation, JMA’s estimated epicenter sat roughly 500 km from the USGS location. That fits a processing error. It doesn’t prove the cause, and only JMA can confirm it.

It has happened before. On 8 August 2013, JMA warned of intensity 7 in Nara and Osaka for an M2.3 earthquake, because a faulty seabed seismometer fed noise into the calculation (JMA). On 30 July 2020, an M5.8 near Torishima set off warnings across 15 prefectures without shaking anyone, after the system put the epicenter in the wrong place and estimated M7.3 (JMA). JMA rebuilt its methods after 2013 and again in 2023, specifically to cut overestimates.

One question deserves a straight answer. JMA’s published rule is to cancel only warnings caused by things that aren’t earthquakes, such as lightning. It doesn’t normally cancel overestimates of real ones. On 16 October there was a real earthquake, and the warning was cancelled anyway. An apology isn’t an explanation. The cause report should say why.

Why “was it hacked?” is now the reflex

Look at the six weeks before it. I’ve tracked 145 publicly reported Japan-related cyber incidents since early September. In the same week, Burger King Japan disclosed about 11.18 million app-member records and SourceNext up to 22.5 million, pulled through its own member-lookup API. Ransomware at IDC Frontier cut service to about 495 companies and local governments. The Digital Agency disclosed a breach of the government’s shared IT platform 78 days after detecting it. And JPCERT/CC has confirmed that attackers are using AI to scan for known vulnerabilities and attack through APIs.

One incident is right on point. Arcadia’s SpeeCAN RAIDEN, the service local governments use to send disaster and safety alerts by email, was breached. Around 111 local governments and other bodies were affected, and up to about 3.1 million email addresses may have leaked. Yokosuka has already reported phishing sent to those addresses. The alert-delivery chain has been hit once already this autumn. People who suspect the alert system aren’t being paranoid. They’re reading the news.

A smartphone lying on a table showing a Japanese Earthquake Early Warning screen with a yellow shaking-building icon
An Earthquake Early Warning received on a smartphone in Japan on 26 May 2023, for an earthquake off the east coast of Chiba. Photo: RuinDig/Yuki Uchida, Wikimedia Commons, CC BY 4.0.

The real threat is trust

From here on, this is my argument, not a reported finding.

Every loud false alarm teaches millions of people that the warning might be wrong. On 16 October they got two blaring alerts in eight minutes, and nothing happened. The danger is the next warning, the one where the seconds count, and people stop to check X first.

Between the alert and JMA’s explanation, there’s a vacuum. Hours after the apology it was still open, and rumor fills it: “the government was hacked,” “the alert system is compromised,” “download this app for real alerts.” Leaked alert-service addresses are already being phished. Alert-themed lures are the obvious next step.

Compromising J-Alert is hard. Making people believe it’s compromised is cheap: one convincing fake screenshot or one fake “official clarification” will do it. Either way, people ignore the real warning. And every long silence, like the Digital Agency’s 78 days, teaches people to assume the worst.

It’s the same lesson as my piece on sovereign AI: resilience depends on trust and visibility, not just uptime. A warning system nobody believes has failed, even if every server is clean.

What good looks like

For JMA and the government:

  • Explain quickly, in public, with the data. JMA published the 2020 cause the same day, and in 2013 it issued a same-day statement and a full root cause within two weeks. Do that again.
  • Say plainly whether tampering is ruled out, and on what basis. Silence leaves the hacking theory standing.
  • Name one place to confirm a cancellation or correction, and keep that channel beyond doubt.

For organizations in Japan:

  • Know who sends alerts on your behalf. Arcadia shows the alert channel is a vendor chain too.
  • Write down which official sources confirm a warning, and make sure staff know social media isn’t one of them.
  • Draft your messages now, for a false alert and for a breach at your alert vendor. In the vacuum, the first credible message wins.
  • If your notification vendor leaked contacts, warn customers before the alert-themed phishing arrives.

Where I come in

I’m an IT infrastructure advisor in Tokyo, with 14 years in Japan and fluent Japanese. I help organizations see who actually runs their systems, alerts and notifications included, and get ready for the day something misfires or someone claims it was hacked.

A good place to start is my external exposure check: up to three domains, public information only, with a written report in five business days and a 30-minute debrief, for ¥100,000 + tax. Diagnostics goes further, into the vendors, accounts, and access paths behind your systems. Write to me at matt@mkultraman.com, in English or Japanese.

About the figures

Incident counts come from my working tracker of 145 publicly reported incidents between early September and 15 October 2026 (JST). The 500 km offset is my own great-circle calculation between JMA’s estimated epicenter and the USGS location.

The next part, Doing something isn’t the same as fixing it, looks at breach responses that create confidence without understanding.

Sources