Japan orders cyber defense upgrades after wave of data leaks hits millions
Tokyo issues urgent instructions to ministries and companies following sophisticated attacks that exposed customer records at major firms.
Key points
- The National Cybersecurity Office directed agencies and businesses to enhance security measures on Friday.
- More than twenty major Japanese companies have reported breaches affecting millions of customers recently.
- New legal powers allow the government to neutralize attacker tools under an active defense law.
The Japanese government issued urgent directives on Friday requiring ministries, local authorities and private companies to strengthen their cybersecurity defenses. According to the Associated Press, the National Cybersecurity Office sent these instructions in response to a wave of attacks that have compromised the data of millions of customers across the country.
Digital Transformation Minister Toshiharu Furukawa stated this week that the ongoing attacks are becoming increasingly sophisticated. The government’s guidance covers fundamental security practices, including updating software, enforcing strong passwords and tightening supply chain controls. Officials also warned that attackers are impersonating cyber defense professionals and using artificial intelligence to complicate vulnerability exploitation, the Associated Press reported.
Emergency Status and Legal Powers
The ruling Liberal Democratic Party convened an emergency meeting of its cybersecurity strategy headquarters on the same day as the directive. Its head, Masaaki Taira, declared that Japan is in a state of emergency in cyberspace, according to the Financial Times. The outlet noted that more than twenty major Japanese companies have disclosed attacks in recent weeks.
Deputy Chief Cabinet Secretary Yusuke Nakanishi confirmed on Wednesday that the government can now take access neutralization steps to stop attackers from using their tools, The Japan Times reported. These authorities came into force on 1 October under Japan’s active cyber defense law, allowing for more proactive measures against ongoing threats.
Affected Organizations and Data Leaks
An attack on the car-sharing service Times Car last month leaked data from approximately 6.6 million member accounts, according to the Associated Press. The breach included images of driving licenses. Other major entities reporting customer data leaks include Lawson, Daiwa Securities and Bookoff, further highlighting the widespread nature of the current threat landscape.
Rail operator JR East lost 1.67 million customer email addresses, the Financial Times reported. In response to the use of forged identification in these incidents, Japan’s Financial Services Agency has instructed banks to accept only ID with a chip, such as passports and My Number cards.
On 7 October, SoftBank’s cloud subsidiary IDC Frontier reported a ransomware attack that disrupted services for 495 companies and local governments, The Asahi Shimbun reported. The outage halted the logistics system of Nissui Logistics at seventeen sites and took the websites of Ibaraki Prefecture offline.
Rising Threat Landscape
The National Police Agency recorded a record 123 ransomware incidents in the first half of 2026, The Japan Times reported. While some observers speculate about the role of AI, experts told the paper there is no firm evidence that AI guided the recent attacks. Paul Ziegler of Reflare noted that large language models are drastically reducing the cost of skilled hackers, making attacks more accessible.
South Korea has also experienced similar cyber incidents, indicating a broader regional trend. That suggests the threat actors are operating across multiple jurisdictions with increasing frequency. No specific fix for the vulnerabilities has been confirmed yet by the affected vendors.
What should you do?
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: Japan
- Review recent logs for unauthorized access attempts or unusual administrative activity.
- Ensure all security software is updated to the latest available versions.
- Verify the identity of any external contacts claiming to provide cyber defense services.
- Monitor official channels for updates on new legal powers or specific threat indicators.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the government confirm that AI caused the recent attacks?
No, experts told The Japan Times that there is no firm evidence AI guided the recent attacks, though costs for hacking are dropping due to LLMs.
What new legal tools does the Japanese government have?
Under the active cyber defense law effective 1 October, the government can take access neutralization steps to stop attackers using their tools.
Which major companies have reported data leaks?
Times Car, Lawson, Daiwa Securities, Bookoff and JR East have all reported customer data leaks or losses in recent weeks.
