Japan steps up cyber warnings as data leaks hit millions of customers

Japan’s government has told ministries, local authorities and companies to step up their cyber defences. A wave of attacks has exposed the data of millions of customers. The National Cybersecurity Office sent the instructions on Friday, the Associated Press reported .

“The attacks are getting increasingly sophisticated,” Digital Transformation Minister Toshiharu Furukawa said this week.

The same day, the ruling Liberal Democratic Party held an emergency meeting of its cybersecurity strategy headquarters. Its head, Masaaki Taira, said Japan was in “a state of emergency in cyber space”, the Financial Times reported . More than 20 major Japanese companies have disclosed attacks in recent weeks, according to the FT.

The instructions cover basics, AP reported. They include updating security software, using strong passwords and tightening security across supply chains. They also warn that attackers have posed as people defending against cyberattacks, and that AI is making vulnerabilities more complex.

Deputy Chief Cabinet Secretary Yusuke Nakanishi spoke on Wednesday, The Japan Times reported . He said the government can now take “access neutralization” steps to stop attackers using their tools. Those powers came into force on 1 October under Japan’s active cyber defence law.

Last month, an attack on the car-sharing service Times Car leaked data from about 6.6 million member accounts, according to AP. Lawson, Daiwa Securities and Bookoff have also reported customer data leaks.

The rail operator JR East lost 1.67 million customer email addresses, the FT reported. The Times Car leak included images of driving licences. Japan’s Financial Services Agency has since told banks to accept only ID with a chip, the FT reported. That includes passports and My Number cards.

On 7 October, the SoftBank cloud subsidiary IDC Frontier reported a ransomware attack, The Asahi Shimbun reported . The outage hit 495 companies and local governments. It halted the logistics system of Nissui Logistics at 17 sites and took the websites of Ibaraki Prefecture offline.

The National Police Agency logged a record 123 ransomware incidents in the first half of 2026, The Japan Times reported. Experts told the paper there is no firm evidence that AI guided the recent attacks.

Paul Ziegler runs the security firm Reflare. He said the cost of skilled hackers used to limit attacks.

“LLMs are driving that down drastically,” Ziegler told The Japan Times.

South Korea has also been hit. CrowdStrike has linked breaches at South Korean banks to AI tools and a suspect in China. Last month, the security firm Gambit said AI agents had stolen credit card records , about 600,000 of them. In Canada, AI agents made failed hacking attempts on the national archive.