Japan's cyber emergency, in numbers

What happened

Through September and early October 2026, a run of incidents hit household names. The car-sharing service Times Car reported a leak covering about 6.6 million member accounts, including images of driving licences. JR East said some 1.67 million customer email addresses may have leaked through its booking system. The Lawson convenience-store chain, Daiwa Securities and BookOff also reported customer data leaks. The Financial Times counted more than twenty major companies disclosing attacks in recent weeks.

A separate case shows how far one breach can travel. A ransomware attack on IDC Frontier, a SoftBank cloud subsidiary, disrupted 495 companies and local governments that rely on it: a logistics system stopped at 17 sites and a prefecture's websites went offline.

Ransomware incidents reported in H1 2026 — a record

123National Police Agency, via The Next Web

Organisations disrupted by one cloud provider's ransomware incident

495IDC Frontier case, via The Next Web

Major companies disclosing attacks within weeks

20+Financial Times, via The Next Web

How Tokyo responded

• On 9 October the National Cybersecurity Office sent guidance to ministries for local governments and companies: keep security software up to date, use strong passwords, and tighten security across supply chains — and beware of attackers posing as cyber-defence staff.
• New “active cyber defence” powers took effect on 1 October, letting the government take “access neutralization” steps against attackers' tools.
• The ruling party's cybersecurity headquarters held an emergency meeting the same day.
• The Financial Services Agency told banks to rely on chip-based ID such as passports and My Number cards when opening accounts.

Our reading

Analysis — Altumptic's interpretation of the reporting above.

• One supplier, many victims. The IDC Frontier case is the clearest signal: a single provider's outage reached hundreds of organisations that did nothing wrong themselves. Supplier risk is now first-party risk.
• Stored ID documents are the jackpot. A leaked email address is a nuisance; a leaked driving licence image enables fraud for years. The regulator's move to chip-based ID is a direct answer.
• The gap is still the basics. The official guidance asks for updates, passwords and supplier checks — not exotic defences. Most organisations lose to the basics, not to novel techniques.

What to do this quarter — anywhere

1. List every outside service that holds your customers' data, and what happens to you if it goes down.
2. Stop storing images of ID documents unless the law requires it; if you must, encrypt them and delete on a schedule.
3. Require two-factor sign-in for every admin and every supplier account.
4. Keep offline backups and rehearse a full restore — the restore, not just the backup.
5. Agree in advance who speaks to customers, and verify anyone who calls claiming to be “cyber defence”.