Major Japanese corporations including Times Car, JR East and a SoftBank cloud subsidiary have fallen victim to a coordinated wave of cyberattacks. Officials from Japan's ruling party have characterized the situation as "a state of emergency in cyber space", according to reporting by the Financial Times. In response, Japan's government has instructed ministries, local authorities and businesses to strengthen their cybersecurity posture immediately. The National Cybersecurity Office distributed these directives on Friday, the Associated Press reported.

Digital Transformation Minister Toshiharu Furukawa remarked that "The attacks are getting increasingly sophisticated." The Liberal Democratic Party convened an emergency meeting of its cybersecurity strategy headquarters the same day. Party chair Masaaki Taira declared Japan was experiencing "a state of emergency in cyber space", according to the Financial Times. Over 20 major Japanese enterprises have reported attacks in recent weeks.

Government directives focus on foundational security

The government's guidance addresses essential cybersecurity practices, the Associated Press reported. These encompass software updates, robust password protocols and reinforced supply chain protections. Officials also cautioned that threat actors have impersonated cybersecurity professionals and warned that artificial intelligence is amplifying the complexity of security vulnerabilities.

Deputy Chief Cabinet Secretary Yusuke Nakanishi announced on Wednesday that the government now possesses authority to implement "access neutralization" measures to disable attacker infrastructure, The Japan Times reported. These powers became available on 1 October following the enactment of Japan's active cyber defence law.

Scale of customer data exposure

The car-sharing platform Times Car experienced a breach affecting approximately 6.6 million member accounts last month, according to the Associated Press. The compromised information included images of driving licences. Retailers Lawson and Bookoff, along with financial services firm Daiwa Securities, have similarly disclosed customer data breaches.

Railway operator JR East reported the loss of 1.67 million customer email addresses, the Financial Times reported. Following this incident, Japan's Financial Services Agency has mandated that banks accept identification documents only if they contain embedded security chips, including passports and My Number cards.

On 7 October, IDC Frontier, a cloud subsidiary of SoftBank, disclosed a ransomware attack, The Asahi Shimbun reported. The incident disrupted services for 495 companies and municipal governments. Nissui Logistics experienced system outages across 17 distribution facilities, while websites operated by Ibaraki Prefecture went offline.

Ransomware incidents reach record levels

Japan's National Police Agency documented 123 ransomware incidents during the first half of 2026, marking a record high, The Japan Times reported. Security researchers have stated there is insufficient evidence linking artificial intelligence directly to these recent attacks.

Paul Ziegler, founder of security firm Reflare, observed that "LLMs are driving that down drastically," referring to the cost barrier that previously limited access to skilled hackers. The emergence of large language models has substantially reduced the financial requirements for conducting sophisticated attacks.

Regional pattern of AI-assisted breaches

South Korea has experienced similar attacks. CrowdStrike has attributed breaches at South Korean financial institutions to AI tools and a suspect operating from China. Last month, security researchers at Gambit identified AI agents responsible for stealing approximately 600,000 credit card records. In Canada, artificial intelligence-powered attack attempts targeted the national archive, though these efforts ultimately failed.

Source: The Next Web