Japan Declares Cyberspace Emergency After Attacks on More Than 20 Major Companies

Japan's government declared an emergency in cyberspace on Friday, Oct. 9, after a run of breaches that has exposed customer data at more than 20 major companies.

Cybersecurity Minister Toshiharu Furukawa called the situation "extremely critical" at a meeting of the National Cybersecurity Strategy Headquarters. Masaaki Taira, the former digital minister who heads the body, described it as a "state of emergency in cyberspace."

The breaches

The Financial Times counted more than 20 major firms reporting attacks, with tens of millions of pieces of customer data lost.

Times Car, the car-sharing and rental operator, disclosed a breach affecting about 6.6 million accounts. Convenience chain Lawson said 2.15 million customer records were illegally accessed, with names, emails and credit card details potentially leaked.

JR East, the country's largest rail operator, reported that 1.67 million customer email addresses were taken from its booking system. That incident traces to a ransomware attack on IDC Frontier, a SoftBank subsidiary that hosts systems for other companies. Tech Times, citing its own reporting, says the IDC Frontier attack cascaded through 495 client businesses within hours and puts the number of citizens whose personal information was compromised at more than 14 million. Those two figures rest on that one account.

The pace is unusual. Data from TrendAI shared with Reuters shows Japan recorded more cyber incidents in the first nine months of 2026 than in all of 2025. Tech Times reports 86 incidents in September alone and a year-to-date total past 500, against 473 for all of 2025 and 503 in 2024.

Silicon Republic reports that Japan logged 123 ransomware cases between January and June.

The government response

The Financial Services Agency issued a warning to financial institutions on Oct. 9, urging them to review their cybersecurity defenses, including third-party risk management and response systems, and to fix any shortcomings.

Finance Minister Satsuki Katayama said at a press conference the same day that banks should apply proper verification when opening new accounts, including by requiring ID cards with chips. "In recent years, there have been a series of unauthorised access incidents in various industries, resulting in numerous cyber incidents in which customer information, including images of identity verification documents, has been leaked," Katayama said.

The FSA has reportedly asked lenders to accept only chip-based identification, such as passports or MyNumber national ID cards. The trigger is the volume of driver's license images leaked in the Times Car attack. A stolen license scan is now a problem for banks, not just for the rental company that lost it.

The National Cybersecurity Office and the Ministry of Internal Affairs and Communications also issued warnings. Businesses were asked to consider security measures at their contractors and to strengthen authentication. Tech Times reports the Cybersecurity Office sent mandatory security instructions to all government ministries, to be passed down to local governments and private operators.

Is AI behind it?

Some security specialists say AI is part of the story. No one has formally tied this wave to AI use, and the specialists say so themselves.

Masaki Hiraoka, managing director for north-east Asia at Blackpanda, told the Financial Times that AI lets attackers skip time-consuming groundwork. "Smaller services that previously weren't worth the effort could become viable targets," he said.

Nobuo Miwa, president of Tokyo-based S&J Corp, compared the attacks to "carpet bombing" in a statement to Reuters. He added that AI tools may be helping foreign hackers get past the language barrier that once made Japanese firms harder to hit.

Taira, per Tech Times, put it this way at the emergency session: "When AI takes over part of the process, a small group of hackers can target significantly more systems."

The caveat from Hiraoka is that the link is inferred from what the technology makes possible, not established by forensic findings on these specific attacks.

Why Japan is exposed

Cybersecurity experts cited by the Financial Times say Japan is more vulnerable because of an aging population with comparatively weaker security habits, and because businesses have been slow to digitize their systems.

The cost of weak defenses has already shown up outside IT departments. In October 2025, an attack on Asahi Group Holdings shut down most of the company's 30 domestic factories and caused shortages of Asahi Super Dry beer.

The IDC Frontier episode shows the concentration risk. When many companies run on one provider, a single breach can reach hundreds of them at once. That is the claim Tech Times makes about the 495-client cascade, and it is consistent with JR East's exposure through the same provider.

What comes next

The immediate test is whether banks adopt the chip-ID standard Katayama and the FSA are pushing, and how quickly. Whether the emergency declaration leads to anything beyond the warnings and directives already issued is not yet known. Nor is it clear whether investigators will find that AI actually drove any of these intrusions, the question Hiraoka's caveat leaves open.