Japanese officials have described the country as being in a state of emergency in cyberspace after a
wave of attacks on more than 20 major companies exposed personal data of over 14 million people. A
ransomware attack on a SoftBank-owned cloud provider alone disrupted 495 companies and local
governments. Organisations with operations or suppliers in Japan should check their exposure to the
affected providers, warn users about follow-on fraud, and tighten supplier security now.
1. The Emergency Statement
On 9 October 2026, Masaaki Taira, head of the ruling Liberal Democratic Party’s cybersecurity strategy headquarters,
said Japan was in “a state of emergency in cyber space” after an emergency meeting. The same day, the National
Cybersecurity Office sent mandatory security instructions to ministries, to be passed on to local governments and private
companies. Minister Toshiharu Furukawa called the situation “extremely critical”. This is a political and administrative
warning, not a formal legal state of emergency.
2. Scale of the Breach Wave
Media reports put the total exposed at more than 14 million citizens; no official breakdown has been published. The
Financial Times reports more than 20 major companies disclosed attacks in recent weeks. Japan recorded 86 cyber
incidents in September, up 37% on July, and the National Police Agency logged a record 123 ransomware cases in the
first half of 2026.
3. IDC Frontier Supply-Chain Ransomware
Ransomware hit IDC Frontier’s IDCF Cloud East Japan Region 1 at 3:40 AM on 7 October 2026. The SoftBank
subsidiary shut down affected systems and disabled customer management console access in all regions. The outage
reached 495 companies and local governments, taking Ibaraki Prefecture websites offline. IDC Frontier is still
investigating scope, and no group has claimed the attack.
4. Government Response
Japan’s Active Cyber Defence law took effect on 1 October 2026, allowing the National Police Agency and Self-Defense
Forces to access and neutralise attack servers, subject to approval and oversight. The Financial Services Agency told
banks to stop accepting a driving licence as sole proof of identity. No state or criminal actor has been named, and experts
report no firm evidence that AI guided these attacks.
- Times Car (Park24 Group): 6.6 million members’ names, addresses, dates of birth, phone numbers, email addresses, and driving licence images, disclosed 25 September 2026.
- JR East and View Card: Email records exposed via email services on affected infrastructure; reported as up to 6.09 million records (the Financial Times reports 1.67 million email addresses).
- JR Kyushu and Tokyo Metro: JR Kyushu reported 1.3 million email records; Tokyo Metro reported email addresses of 59,000 Metpo loyalty members.
- Daiwa Securities: Up to 220,000 records exposed through a compromised contractor server.
- Other victims: Lawson, FamilyMart, and Bookoff reported customer data leaks; Keio Corporation was hit by ransomware on 26 September; Nissui Logistics halted operations at 17 sites after a third-party data centre outage.
5. Recommendations
- Check whether your organisation or suppliers use IDC Frontier’s IDCF Cloud or the breached Japanese providers, and rotate any credentials, API keys, or VPN access shared with them.
- Warn staff and customers in Japan about phishing and identity fraud using leaked names, email addresses, and driving licence images; do not accept a licence image alone as proof of identity.
- Apply the Japanese government’s guidance: patch internet-facing systems, enforce strong passwords with multi-factor authentication, keep offline backups, and tighten supplier security controls.
6. Sources
- https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/
- https://thenextweb.com/news/japan-cyberattacks-warning-data-leaks
- https://www.techtimes.com/articles/328908/20261012/japan-declares-first-cyberspace-emergenc
y-ai-turns-ransomware-carpet-bombing.htm
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.