Japan's government told companies, banks and public bodies to tighten their cyber defenses on Friday, October 9, 2026. More than 20 major Japanese companies have disclosed attacks in recent weeks. The largest leak, at the car-sharing service Times Car, exposed about 6.6 million member accounts, including images of driving licenses. A senior cybersecurity official in the ruling party called it "a state of emergency in cyber space."
What Japan's government told companies to do
The National Cybersecurity Office sent instructions to ministries, local authorities and companies on Friday, TNW reports. It told them to update security software, use strong passwords and tighten security across their suppliers. It also warned about attackers posing as defenders, and said AI is making weak points in systems more complex.
According to Silicon Republic, the office asked businesses to quickly consider further measures, including for their contractors. It asked them to fix known weak points and strengthen authentication, the checks that confirm who is logging in. The Ministry of Internal Affairs and Communications sent a similar warning to the businesses it oversees.
An emergency meeting was held the same Friday. Masaaki Taira, a former digital minister, called the situation "a state of emergency in cyber space," as quoted by the Financial Times. The reports describe his role differently. TNW says he leads the ruling party's cybersecurity strategy headquarters and is not a minister. Silicon Republic calls the body the National Cybersecurity Strategy Headquarters.
"The attacks are getting increasingly sophisticated," said Digital Transformation Minister Toshiharu Furukawa, according to TNW.
Which Japanese companies were hit
The Financial Times counted more than 20 major companies that disclosed attacks in recent weeks, TNW reports. These are the largest named cases.
| Company | What was reported | Reported by |
|---|---|---|
| Times Car (car sharing) | About 6.6 million member accounts, including driving license images; disclosed late September | TNW, Silicon Republic |
| Lawson (convenience stores) | 2.15 million customer records accessed; names, emails and card details possibly leaked | Silicon Republic |
| JR East (railway) | 1.67 million customer email addresses | TNW, OODAloop |
| IDC Frontier (SoftBank cloud unit) | Ransomware attack on October 7 | TNW, OODAloop |
| Daiwa Securities, Bookoff | Customer data leaks | TNW |
The IDC Frontier outage spread widely. TNW, citing the Asahi Shimbun, says it hit 495 companies and local governments. It stopped Nissui Logistics' logistics system at 17 sites and took Ibaraki Prefecture's websites offline. OODAloop links the JR East leak to that ransomware attack. TNW does not say how the addresses were taken.
The National Police Agency recorded 123 ransomware incidents in the first half of 2026, a record, according to TNW.
Banks told to stop relying on driving licenses
The Financial Services Agency warned financial institutions on October 9 to take "appropriate measures," Silicon Republic reports. That includes reviewing how they manage risk from outside suppliers. Finance Minister Satsuki Katayama said the same day that banks should check identity properly when opening new accounts, including by requiring ID cards with a chip.
TNW says the agency told banks to accept only chip-equipped IDs, such as passports and My Number cards, Japan's national ID card. OODAloop says the change follows the Times Car leak, which exposed images of driving licenses.
New defense powers and the AI question
Japan now has a new tool. Under its active cyber defense law, powers to take "access neutralization" steps against attackers' tools came into force on October 1. Deputy Chief Cabinet Secretary Yusuke Nakanishi said on October 8 that the government can now use them, TNW reports.
AI's role is disputed. Paul Ziegler of the security firm Reflare told the Japan Times that large language models are lowering the cost of attacks: "LLMs are driving that down drastically." But experts also told the paper there is no firm evidence that AI guided these attacks. Experts cited by the Financial Times point instead to Japan's aging population, weaker security habits and slow move to digital systems.
What this means for developers
For teams that build, buy or run systems in Japan, or serve Japanese customers:
- Map your supplier risk. One ransomware attack on a cloud provider hit 495 customers. List the outside services that can take your product down, and plan how to keep running without each one.
- Stop keeping ID images longer than needed. The Times Car leak included driving license images. If your app collects ID photos, encrypt them and delete them once the check is done.
- Update identity checks for Japanese banks. Onboarding flows that accept a driving license photo may need to switch to chip IDs such as My Number cards or passports.
- Turn on strong login checks for contractors. The government asked for stronger authentication, including for contractors. Require two-factor login on every admin and supplier account.
- Expect phishing. Leaked lists such as the 1.67 million JR East email addresses are often used for fake emails. Warn your users, and watch for login attempts that reuse leaked details.
This article was first published on Tech AI Wire.
Also available in
Deutsch · 日本語 · Français · Español · Português
Top comments (0)