The Japanese government declared its first-ever “cybersecurity state of emergency” after a major series of cyber attacks impacted roughly a tenth of the national population and resulted in ransomware breaches at 495 businesses in a matter of hours.
While this specific incident (an initial breach of a cloud services provider that cascaded down to its clients) seems to have been the tipping point in declaring the emergency, it followed a rough month of September in which 86 recorded cyber attacks were logged. This was not only a surge relative to the numbers of previous months, but it pushed Japan past the previous annual record of incidents with a quarter of the year still left to go.
National emergency declared after “extremely critical” data breach
The attack took place on October 8 and involved IDC Frontier, a large domestic cloud services provider owned by technology giant SoftBank. The breach impacted numerous downstream clients of IDC Frontier, some in possession of large quantities of personal information. The biggest of these include national railway operator JR East, which may have exposed some 6.09 million records via its payment subsidiary View Card. Another impacted client was fellow railway operator Kyushu Railway Company, which is thought to have had over one million email records exposed by the breach.
In total some form of personal information for about 14 million citizens is thought to have been exposed by the rash of cyber attacks. The speed at which follow-up attacks took place after the initial IDC Frontier breach points to AI assistance. This is not at this point thought to be another “rogue autonomous AI” incident. However, head of the National Cybersecurity Strategy Headquarters (NCSH) Masaaki Taira told an emergency session convened on October 9 that AI was likely part of the process of a coordinated attack campaign against Japan’s legacy cyber infrastructure. The national emergency was declared at this meeting.
The cyber attacks are also likely to cause extended business interruption. IDC Frontier has stated that customers can only expect to recover data if they have their own accessible backup copies. The attacks come in the middle of a government-supported push for Japan’s businesses to transfer data from troublesome legacy systems to cloud service providers such as this, with some likely believing that their data was now more secure after being transferred.
AI breaks Japan’s “language firewall” against cyber attacks
The early October cyber attacks came just after another major incident in late September, involving 6.6 million records of personal information. Times Car, a major vehicle rental service operated by leading parking operator Park24, disclosed a breach that exposed full names and contact information along with images of driver’s licenses and other identity verification documents used by customers. This incident was bad enough to prompt the country’s Financial Services Agency to issue guidance to the nation’s banks that standard driver’s licenses should no longer be accepted as a singular form of identity verification, instead looking for an ID that contains a chip such as the MyNumber national identity card.
Yet another major railway operator, Keio Corporation, also disclosed a ransomware attack around the same time in late September. The rash of cyber attacks in Japan in 2026 is not thought to be a coincidence; it is most likely the consequence of advanced AI-driven tools coming into the hands of criminals. Japanese organizations were previously one of the harder targets for hackers in the world, due primarily to the language barrier. Smaller to mid-size businesses could get by with outdated legacy systems and major cybersecurity deficits as they were simply seen as not worth the effort to target. AI is smashing down these barriers with its advanced translation capability and relentless probing of weaknesses, however.
This has all prompted the National Cybersecurity Office to issue its own set of guidance to businesses and local governments throughout the nation. The guidance includes some cybersecurity staples such as password hygiene and ensuring patching and updating is taking place, but also specifically warned about the complexity of emerging AI-driven cyber attacks and also detailed specific social engineering approaches in which the attackers pose as members of cyber defense teams.
IDC Frontier’s parent company SoftBank may also be entering the fray with some support in the near future, at least for critical infrastructure companies in the country. The software giant previously announced that it is developing its own “state of the art” AI-driven security solution for Japanese organizations that face a high level of regular threat, such as the financial industry and utilities. The Japanese government also activated the Active Cyber Defense (ACD) law at the start of October, which gives national law enforcement agencies new powers to proactively attack and disable malicious servers and infrastructure.
