Cybersecurity in Japan, October 2026: Threats, Laws and the Checks to Run Now

1. What is happening in autumn 2026

The largest cases so far. Every figure is the maximum number each organisation said may have been affected, not a confirmed count.

• IDC Frontier (IDCF Cloud): from about 03:40 on 7 October, part of the East Japan Region 1 was stopped by ransomware. 495 companies and local governments were affected, and customers were told to restore from their own backups. JR East and Views Card disclosed that up to about 6 million member records may have leaked.
• Ride On Express (Gin no Sara, Kamadora, Sushi Jotou): on 13 October, up to 6.5 million registered-user records may have leaked. No card data was held.
• Arcadia (SpeeCAN RAIDEN, an alert-distribution service used by local governments): suspicious activity detected on 11 October. Up to about 3,136,000 email addresses and about 105,000 phone numbers, among other data. By 15 October, 125 public bodies had issued notices to residents (a count of notices, not of confirmed leaks).
• Yakiniku King (Monogatari Corp.): 10,788,963 app members. Book Off: up to 6.43 million through a subsidiary's system. Sky Ticket: more than 14 million.
• Daiwa Securities and Citizen Watch: one night of unauthorized access to an FAQ system run by their vendor Scala Communications affected about 110,000 and about 100,000 people.
• Nikkei: one employee's Microsoft 365 account sent about 9,000 suspicious emails on 30 September. A separate Google Workspace account had been logged into from late July; Google's notification revealed it.
• Burger King Japan (BK Japan): unauthorized access to the system holding official-app member data between 2 and 7 October, discovered on 13 October. About 11.18 million records (member ID, email address, name, date of birth, phone number and more). No card numbers are held and no password leak has been confirmed; the cause is under investigation with an outside firm.

The table below sorts the cases disclosed between 25 September and 6 October by entry point. The full timeline, and who noticed each breach first, is in Japan's October 2026 breach wave: how the attackers got in and who noticed first.

Television asked whether a state was behind the wave. Chief Cabinet Secretary Minoru Kihara said on 6 October that it was not clear whether the incidents were related and that the government was analysing methods and trends. A security company that analysed attack traffic told NHK that the methods changed at a speed and variety "difficult for humans", suggesting AI agents may have been misused. That is a reported possibility, not a finding. The question that helps defenders is how the attackers got in, which is the next section.

2. How Japanese companies are actually being breached

Ransomware: 123 cases in six months, about 60 percent of them SMEs

The National Police Agency's report for the first half of 2026 counts 123 ransomware reports between January and June, the highest half-year figure since the statistics began in the second half of 2020. About 60 percent of the victims were small and medium-sized companies. Among the organisations that answered the survey, about half were first entered through a VPN device; about 60 percent spent JPY 10 million or more in total on recovery, and under half recovered within a month. The same report puts suspicious access detected by police sensors at 13,687 per day per IP address, up 50.7 percent on the year, most of it from overseas.

In early October, Japanese police detained a Russian national believed to be a core member of the Qilin ransomware group, which claimed the 2025 outage at Asahi Group Holdings, and handed him to Germany at Germany's request. The group told the broadcaster JNN that Japan has "one of the worst computer security systems in the world", that attacks on Japanese companies could increase, and that it works with more than 300 anonymous partners. One arrest does not change what reaches your VPN tonight.

Vendor systems

Daiwa Securities' and Citizen Watch's customer data sat in an FAQ system that Scala Communications runs for up to five client companies. Tokyo Metro's about 59,000 email addresses were on a mail vendor's server, and Yoshinoya's applicant records were in a recruiting platform it had stopped using. In the Arcadia case, one company's system exposed residents' data held for more than 100 local governments and fire departments. Under the APPI, when a leak happens at a vendor, the duty to report lies with the company that entrusted the data.

Vulnerabilities and configuration in internet-facing applications

Shueisha blamed a configuration error in its CMS, GMO Research and AI a software vulnerability, and Mr Max the misuse of a software feature. In its 9 October alert, the IPA did not conclude that a specific product's vulnerability was being targeted; it said the incidents appear to start from compromised internet-facing applications and accounts.

Hijacked accounts

At Nikkei, one Microsoft 365 account sent about 9,000 emails, and a separate Google Workspace account had been accessed for more than two months. In a cloud email environment, one hijacked account turns into phishing of your customers and invoice fraud in your name. This is also the most common type of investigation CS2 is asked to run (Microsoft 365 investigation).

The phishing supply chain: a Microsoft takedown that began with Japan's police

Phishing emails, the usual entry to an account takeover, are sold by businesses. On 14 October Microsoft announced that, under an order of the United States District Court for the Southern District of Florida, it had seized the infrastructure behind YAM Store, a Chinese-language cybercrime marketplace, and the CoGUI and Iron Man phishing kits. The investigation started in late 2025 when Japan's National Police Agency alerted Microsoft to messaging scams targeting people in Japan, and JC3 (the Japan Cybercrime Control Center) confirmed the scale of the impact on Japanese companies and financial institutions. According to Microsoft, the three services have enabled more than one billion malicious emails and text messages against more than 75,000 organisations in more than 150 countries since January 2026, and CoGUI targeted victims in Japan and the United States in particular. Microsoft has disabled more than 20,000 related accounts and blocked more than 100,000 domains used for impersonation.

The technical report has four points that matter directly to smaller companies. YAM Store obtained Microsoft 365 tenants fraudulently, by buying expired domains of real organisations and rebuilding their websites, and sold the accounts. In hijacked tenants the operators used Global Administrator rights to grant applications broad Microsoft Graph permissions and used SharePoint and OneDrive to host phishing pages. The Iron Man kit receives the victim's input over a WebSocket in real time and notifies the operator through Telegram, so it can walk the victim through entering a verification code. Microsoft's recommendations are to move to phishing-resistant multi-factor authentication such as passkeys, to require it for privileged accounts through Conditional Access, and to limit who holds Global Administrator. The report's figures include a Japanese-language lure impersonating a financial service provider, and Japan is listed among the most affected countries.

Virtualization platforms and cloud

At Osaka Metropolitan University the attackers reached the virtualization platform behind the campus systems; about 500 servers stopped and most backups were encrypted too. At IDC Frontier, virtual servers in four zones of one region could not restart, and the company told customers to restore from their own backups. The common thread is that the backups depended on the same platform that went down.

3. The regulatory picture: what changed in 2026

On top of these, financial institutions follow the Financial Services Agency's guidelines, telecom carriers have duties under the Telecommunications Business Act, and critical infrastructure operators are subject to prior screening under the Economic Security Promotion Act. This guide covers the three regimes that apply regardless of sector.

4. APPI: current duties and the 2026 amendment

Duties that apply now

The Act on the Protection of Personal Information applies to every business handling personal data of people in Japan, including foreign businesses that offer goods or services to people in Japan. The autumn cases put one part of it under the spotlight: what happens after a leak.

• Leaks that must be reported: leaks involving sensitive personal information; leaks that could cause financial damage through misuse (card numbers, for example); leaks caused with wrongful intent (unauthorized access qualifies); and leaks affecting more than 1,000 people. Any one of these triggers the duty, however small the count.
• Deadlines: a preliminary report to the Commission within roughly 3 to 5 days, and a final report within 30 days (60 days when the leak was caused with wrongful intent). The affected individuals must also be notified.
• Leaks at a vendor: the reporting duty lies with the company that entrusted the data. Waiting for the vendor's report means missing the preliminary deadline.
• Security measures: organisational, personnel, physical and technical measures, supervision of vendors, and awareness of the legal environment of any foreign country where the data is handled.
• Cross-border transfers: where a transfer relies on consent, the individual must be told about the destination country's data protection regime. Sharing data with a head office abroad is a transfer.

What the 2026 amendment changes

The Act Partially Amending the Act on the Protection of Personal Information passed the House of Councillors on 10 July 2026 and was promulgated on 17 July. The main points (Monolith Law Office, ScanNetSecurity):

• Administrative surcharge: for violations of the ban on improper use, the proper-acquisition rule, the third-party provision restrictions and the statistical-use exceptions that are likely to seriously harm individuals' rights, the Commission can order payment of an amount equal to the economic benefit obtained. The calculation method is left to lower-level rules.
• Stronger penalties: the offence of unlawfully providing a personal information database now also covers provision intended to harm others, and obtaining personal data by fraud or unauthorized access becomes a new offence.
• Children's data: for people under 16, consent and notices go to the legal representative, suspension requests are easier, and a duty to consider the child's best interests is added.
• Biometric data: additional disclosure duties for facial feature data and similar, and a ban on third-party provision under the opt-out system.
• Statistics and AI development: no consent needed for use or third-party provision limited to creating statistics or developing AI models, under conditions including that the data is not used to identify individuals.
• Notification of individuals: eased for leaks with a low risk to rights and interests. Reporting to the Commission remains.
• Effective date: set by cabinet order within two years of promulgation, so by July 2028 at the latest.

5. The Active Cyber Defense law

The Cyber Response Capability Enhancement Act and its implementation act move the government from responding after an attack to detecting signs and acting against attack sources. According to @IT's explainer, the provisions in force since 1 October are:

• Reporting duties: critical infrastructure operators that use designated critical computer systems must report the product and manufacturer when such a system is introduced, must promptly report a specified incident to the competent minister and the Prime Minister, and must file a report on the overview, technical details and response within 30 days of becoming aware of it. Ignoring a corrective order over a reporting violation carries a fine of up to JPY 2 million; refusing a request for a report or documents, up to JPY 300,000.
• Access and neutralisation: under set conditions, the Self-Defense Forces can delete malicious programs or change settings on computers used in serious attacks on the state or critical infrastructure. Police measures are scheduled to take effect by November.
• Cybersecurity Council: a public-private body through which the government shares information with members.

What it means for smaller companies

The statutory duties fall on critical infrastructure operators. But operators in power, telecoms, finance, transport, healthcare and the other designated sectors will pass incident reporting deadlines and security requirements down to their suppliers and vendors by contract. If your company supplies a critical infrastructure operator, decide now how many hours it would take you to tell that customer about an incident on your side. The government will also start passing zero-day vulnerability information to operators, so someone in your company, or an outside partner, needs to be able to receive that information and map it to your equipment.

6. Supply chains and the security evaluation scheme

In its 9 October alert, the IPA asked companies to extend their response to overseas sites and business partners, to use METI's Cybersecurity Management Guidelines, to understand risk across the whole supply chain and to work with partners and vendors, and announced that the SCS scheme would start in March 2027.

The scheme gives companies a common scale for showing their security level to business partners. ★1 and ★2 are self-declarations; ★3 is a self-assessment confirmed by an expert; ★4 is an evaluation by a third-party body; ★5 adds advanced operation and continuous improvement (scheme overview). The ★3 measures include multi-factor authentication, privileged account management, patch management with vulnerability assessment, phishing training, backups with offline storage, and log management with incident response procedures. Companies above a certain size are expected to ask their partners for ★3, so for a subcontractor in manufacturing or logistics the practical first step is to map the ★3 items against its own environment.

Related services: security consulting (assessment and 90-day plan), vulnerability assessment, security training and phishing simulation

7. The skills gap and how to use outside help

In most of the autumn cases where the organisation said how it found out, the first sign came from a customer, a third party, a platform provider or a vendor. The reason nobody noticed internally was not technology; it was that nobody read the logs every day. For a company that cannot hire a security specialist, the realistic model is to put three things outside and keep the decisions inside:

• Monitoring: someone reads your existing logs every day: Microsoft 365 or Google Workspace, the VPN device, the servers. CS2 offers this as SecureWatch.
• Investigation: when something looks wrong, preserve the logs, establish the entry point and the scope, and write a report that works for the Commission, your customers and your insurer (incident response and forensics).
• Checks: assess your internet-facing applications and cloud configuration on a schedule (vulnerability assessment, cloud security assessment).

What stays inside is the judgment: what to protect, how much to spend, and who signs off when a leak has to be reported. METI's Cybersecurity Management Guidelines place that responsibility with management. For smaller companies there is also the IPA's Cybersecurity Assistance Team (お助け隊) service scheme, which bundles advice, monitoring and insurance at low cost.

8. The checks to run now: the IPA's 9 October alert

Scrutinise your internet-facing applications

• List every internet-facing application or service your company built or runs itself. Include admin panels, APIs and anything a department set up on its own.
• Read the last month of logs for anomalies, then extend to three months. Error volume and deviation from normal are the indicators. Use the exercise to establish who can examine which logs, and how.
• Check each component for unapplied security patches and apply them promptly.

Services: vulnerability assessment, penetration testing

Inventory the external services you use

• Capture every cloud service, VPN and SaaS, including those used by a single department.
• Compare each service's sign-in records with normal. Volume of failed logins, source IP addresses, time of day. Note how long each service keeps logs and what the provider can see that you cannot.
• Look for accounts you do not remember creating, and for disabled or deleted accounts that have been re-enabled.

Services: cloud security assessment (Microsoft 365, Google Workspace, AWS), daily monitoring with SecureWatch

If anything looks wrong

• Declare a security incident promptly and start the response. The IPA strongly recommends asking a specialist security vendor for a detailed investigation, given the possibility of a leak. Preserving logs is the first task; rebooting servers or changing passwords first destroys evidence.

Services: incident response and forensics (same-day triage), Microsoft 365 investigation

Re-examine the data you hold

• Apply the principle of not holding data you do not need: know exactly what you hold and cut it to the minimum. Times Car's 6.6 million records included former members; Yoshinoya's applicant data should have been deleted when the contract ended.
• Review where the data is stored, what access logs you keep and for how long, and encryption.

Service: risk analysis (quantifying the data you hold and the loss exposure)

Two more, from the police figures

• Patch or replace your VPN appliance and put multi-factor authentication in front of it. About half of the ransomware victims were first entered through a VPN device.
• Keep one backup that neither your IT provider, your hypervisor admin account nor your cloud provider can reach, and restore from it once. Osaka Metropolitan University and IDC Frontier show what happens when the backup depends on the layer that went down.

After the checks

Even where the checks find nothing, the IPA asks companies to reduce what is exposed, strengthen authentication with multi-factor authentication, review accounts and privileges, manage API integrations at component level, review what logs are collected and for how long, and encrypt data. For multi-factor authentication, choose a phishing-resistant method such as passkeys rather than SMS or push approval: kits like CoGUI and Iron Man walk the victim through entering the verification code in real time. It also asks management to see the results and the residual risk, and to lead the response. For staff, phishing simulation and a management tabletop exercise built on the autumn cases is the most practical training available this year.

9. For head offices outside Japan

In a foreign-owned Japanese company, incident decisions tend to flow to the group CISO and legal team abroad, while the legal duty to report in Japan stays with the local entity. Three things prevent the deadline from being missed: an investigation partner that reports in both Japanese and English on the same day, someone who can write the report to the Commission in Japanese, and an agreement made in advance on whether the head office or the Japanese entity signs off on that report. Transfers of personal data from Japan to the head office are cross-border transfers under the APPI, with their own disclosure requirements.

Three further points for group security teams. First, the Japanese entity's Microsoft 365 or Google Workspace tenant is often separate from the group's, and its sign-in logs are read by nobody; the Nikkei case is what that looks like. Second, if the subsidiary supplies a Japanese critical infrastructure operator, incident reporting deadlines under the Active Cyber Defense law will reach it by contract, including for incidents at other sites in the group. Third, the IPA has asked Japanese companies to extend their checks to overseas sites and partners, so expect questionnaires from Japanese customers in the coming months, and the ★3 criteria of the supply-chain evaluation scheme from March 2027.

The Japanese edition of this guide (日本のサイバーセキュリティ 2026年10月版) is written for the local team and covers the same ground.

10. Frequently asked questions

Sources

1. National Cyber Office: alerts issued by government agencies on the unauthorized-access leak incidents (14 October 2026, Japanese)
2. IPA: measures to implement promptly in light of the leak incidents caused by unauthorized access (9 October 2026, Japanese)
3. National Police Agency: threats in cyberspace, first half of 2026 (PDF, Japanese)
4. Ransomware damage at a record high: the NPA's first-half 2026 figures (@IT, Japanese)
5. Ransomware attack on IDC Frontier affects 495 companies and local governments (TECH+, Japanese)
6. IDC Frontier third report: recovery from customers' own backups (Japanese)
7. JR East and Views Card, up to about 6 million records (NHK, Japanese)
8. Book Off, up to 6.43 million (NHK, Japanese)
9. Sky Ticket, more than 14 million (NHK, Japanese)
10. Ride On Express, up to 6.5 million records (INTERNET Watch, Japanese)
11. Arcadia SpeeCAN RAIDEN: the attack and the list of affected public bodies (Japanese)
12. Unauthorized access to a local-government alert distribution system (NHK, 13 October, Japanese)
13. Yakiniku King, 10,788,963 records (Japanese)
14. Daiwa Securities and Scala Communications (INTERNET Watch, Japanese)
15. Citizen Watch and Scala Communications (Japanese)
16. Tokyo Metro, about 59,000 email addresses (Japanese)
17. Yoshinoya and ApplyNow (ITmedia NEWS, Japanese)
18. GMO Research and AI, infoQ (Japanese)
19. Mr Max, up to 1,735,154 people (Japanese)
20. Nikkei, the Microsoft 365 and Google Workspace incidents (Japanese)
21. Osaka Metropolitan University ransomware attack (Japanese)
22. Burger King Japan, about 11.18 million app member records leaked (ORICON NEWS, 15 October, Japanese)
23. Microsoft: Disrupting the service economy behind transnational cybercrime operations (14 October 2026)
24. Microsoft Threat Intelligence: The hidden network inside the phishing infrastructure ecosystem (14 October 2026)
25. Government response and Scala Communications' client count (The Japan Times)
26. Attack traffic analysis and the possible misuse of AI agents (NHK, 13 October, Japanese)
27. Suspected Qilin member handed to Germany (Jiji / The Japan Times)
28. Qilin's statement to JNN (News On Japan)
29. Promulgation of the Act Partially Amending the APPI (ScanNetSecurity, Japanese)
30. Key points of the 2026 APPI amendment (Monolith Law Office, Japanese)
31. What changes with active cyber defense from October, including incident reporting duties (@IT, Japanese)
32. New cybersecurity strategy adopted with active defense written in (Kyodo, 23 December 2025, Japanese)
33. Overview of the Supply Chain Security Evaluation Scheme (Japanese)

Figures are as published by each organisation, government agencies or Japanese media as of 15 October 2026. Most counts are the maximum number that may have been affected, not confirmed leaks. Descriptions of the law are general information, not legal advice. This page replaces the April 2026 edition of the guide.