Ransomware Hits Koka City’s Emergency Broadcast System, Potential Data Leak

Koka City in Shiga Prefecture, Japan, said on 12 November 2026 that a ransomware attack on a server caused the outage of its community voice broadcast system, which went offline early on 11 November.

What happened

The city’s emergency communication platform, which handles alerts, paging, condolence messages and scheduled melody broadcasts, stopped functioning; according to the Chunichi Shimbun, the ransomware attack on the server was identified at around 18:45 that day. The outage also prevented the nationwide J‑Alert test scheduled for 11:00 from reaching Koka residents.

Technical details and impact

City officials announced on 12 November that ransomware was the cause, but they did not disclose the attacker’s identity, the intrusion method, the ransomware family, or whether any data was actually exfiltrated. Residents were instructed to obtain emergency information through official LINE accounts, email, TV, radio and the prefectural disaster app.

The Chunichi Shimbun reported that roughly 25,000 terminal installer names or business names could have been exposed, pending further investigation.

Why it matters

The broadcast system is a critical link for public safety, especially during natural disasters or emergencies. Its disruption means citizens must rely on alternative channels, which may delay receipt of urgent warnings. If the alleged data exposure is confirmed, the information could be used for targeted phishing or fraud attempts against local businesses and individuals.

What residents can do

Anyone who believes their installer or business name may be among the leaked records should be vigilant for unsolicited messages that reference that information. It is advisable to:

• Verify the sender before clicking links or opening attachments.
• Change passwords on any accounts that use the exposed names as usernames or security questions.
• Monitor financial statements and credit reports for unusual activity.
• Report suspicious communications to the city’s cyber‑security helpline.

Outlook

The city has not provided a recovery timeline, stating that the restoration outlook remains unclear. Ongoing investigations aim to identify the attackers, the ransomware variant and the full extent of any data loss.

This brief was prepared with AI assistance from the sources above and reviewed by our editors.