Japan Orders Firms and Agencies to Boost Cyber Defences After Mass Data Leaks

Japan's National Cybersecurity Office sent formal instructions on Friday urging ministries, local authorities and companies to harden their cyber defences, the Associated Press reported. The guidance came as a series of intrusions exposed customer information at major Japanese businesses. Digital Transformation Minister Toshiharu Furukawa said this week that the attacks are becoming increasingly sophisticated.

The same day, the ruling Liberal Democratic Party convened an emergency meeting of its cybersecurity strategy headquarters. Its head, Masaaki Taira, described Japan as being in a state of emergency in cyberspace, according to the Financial Times. The FT reported that more than 20 large Japanese companies have disclosed attacks in recent weeks.

The government's instructions focus largely on fundamentals, per AP, covering software updates, strong passwords and tighter security across supply chains. They also caution that attackers have impersonated defenders, and that artificial intelligence is making vulnerabilities more complex. Separately, Deputy Chief Cabinet Secretary Yusuke Nakanishi said the government can now take access neutralisation steps to stop attackers using their tools, The Japan Times reported, powers that took effect on 1 October under Japan's active cyber defence law.

Among the disclosed incidents, an attack on the car-sharing service Times Car leaked data from roughly 6.6 million member accounts, according to AP, including images of driving licences. Lawson, Daiwa Securities and Bookoff have also reported customer data leaks, while rail operator JR East lost 1.67 million customer email addresses, the FT reported. In response, Japan's Financial Services Agency has told banks to accept only identification documents with a chip, such as passports and My Number cards.

On 7 October, SoftBank's cloud subsidiary IDC Frontier reported a ransomware attack, The Asahi Shimbun reported. The resulting outage affected 495 companies and local governments, halting the logistics system of Nissui Logistics at 17 sites and taking the websites of Ibaraki Prefecture offline. The National Police Agency logged a record 123 ransomware incidents in the first half of 2026, according to The Japan Times, though experts told the paper there is no firm evidence that AI guided the recent attacks.

Paul Ziegler, who runs the security firm Reflare, told The Japan Times that the cost of skilled hackers used to limit the scale of such attacks, and that large language models are driving that cost down drastically. The problem extends beyond Japan: CrowdStrike has linked breaches at South Korean banks to AI tools and a suspect in China. Last month the security firm Gambit said AI agents stole about 600,000 credit card records, and in Canada AI agents made failed hacking attempts on the national archive.