Japan cyber alarm: 20+ firms hit as millions of records leak

Masaaki Taira, who heads the ruling Liberal Democratic Party’s cybersecurity strategy headquarters, told an emergency meeting that Japan was in a state of emergency in cyberspace. Digital Transformation Minister Toshiharu Furukawa warned the same week that attacks are getting more sophisticated.

The government’s National Cybersecurity Office then sent instructions to ministries, local authorities and businesses. They focus on basics: keep security software updated, use strong passwords and tighten security across supply chains, the outside vendors that handle a company’s data. The guidance also warned that some attackers pose as people offering to defend against cyberattacks, and that AI is making security weaknesses harder to manage.

The numbers back up the worry. The National Police Agency counted a record 123 ransomware incidents in the first half of 2026. Ransomware is malicious software that locks or steals data and demands payment.

The first wave hit household names across travel, retail and finance:

• Times Car: the car-sharing service lost data from about 6.6 million member accounts, and about 1.6 million of those included images of driver’s licenses and similar ID. Parent company Park24 says it will delete such images right after checks from now on.
• IDC Frontier: a ransomware attack on the SoftBank cloud subsidiary in early October disrupted 495 companies and local governments, stopping Nissui Logistics at 17 sites and taking Ibaraki Prefecture’s websites offline.
• JR East: the rail operator lost 1.67 million customer email addresses.
• Yamato Transport: 5.31 million records from a deferred payment service, gathered over about eight years, were compromised.
• Others: Lawson, Bookoff and Daiwa Securities reported customer leaks, Nikkei lost about 1.83 million records, and cosmetics brands Fancl and Attenir said about 830,000 customers were affected.

The leak of license photos had an immediate knock-on effect. Japan’s Financial Services Agency told banks to accept only ID with a chip, such as passports and My Number cards, because copies of photo ID were now in criminal hands.

The government’s alert didn’t end the wave. In the weeks since, more organizations have come forward.

Burger King Japan said attackers got into the server holding its app’s member data in early October, exposing more than 11 million records. Names, birth dates, phone numbers and order history were taken, though payment cards and passwords weren’t stored there.

Arcadia, a disaster information firm, was hacked, exposing names and email addresses of about 125,000 officers and staff across 20 prefectural police forces, plus email addresses of people signed up for crime alerts. Recruit flagged a possible leak of 3.7 million accounts on its Carsensor used car site, forcing Nissan, Mitsubishi Motors and Mazda to pause services that relied on it. Brokerage IwaiCosmo Securities said an attack on a contractor, believed to have used AI, led to unauthorized trades in seven customer accounts.

GMO Internet Group said attackers hit the cloud servers it rents to currency traders, putting up to 26,739 servers at risk and leading to unauthorized trades. It’s paying every user ¥5,000 (about $30), plus compensation for trading losses, and says it won’t pay the extortion demand it received.

Japan’s active cyber defense law came into force on October 1. It lets authorities take what officials call access neutralization steps, essentially getting into and disabling servers that attackers use for serious attacks, and it strengthens cooperation between government and private companies. Deputy Chief Cabinet Secretary Yusuke Nakanishi confirmed the government can now use those powers.

GMO has asked the government to invoke the framework for its own breach. If that happens, it would reportedly be the first time it’s been used. How far officials go, and how they avoid hitting innocent systems along the way, will be watched closely by other countries considering similar laws.

On the role of AI, opinions are split. Experts say there’s no firm proof AI directed this wave. But security researchers argue that AI tools are making skilled hacking much cheaper, and a Tokyo security firm warned that AI is helping attackers run many large attacks at once.

If you use any of the affected services, including while traveling or doing business in Japan, expect a wave of convincing scam messages. Leaked names, birth dates and phone numbers make fake security alerts feel real.

The same steps protect you wherever you live:

• Turn on two-factor authentication, which asks for a second code when you log in. Experts said some GMO users who skipped it were easier targets.
• Don’t click links in breach warnings. Open the company’s app or type its web address yourself.
• Never share passwords or one-time codes with anyone who contacts you, even if they cite the breach.
• Use a different password for every account, ideally with a password manager.

For businesses, Japan’s lesson is that many of the worst breaches came through vendors, such as a cloud host, a contractor or an outsourced alert system. Ask your suppliers how they protect your customers’ data.