After more than 20 major firms reported attacks, Japan told ministries and companies to tighten cyber basics
More than 20 major Japanese companies have disclosed cyberattacks in recent weeks, the Financial Times reported. Tokyo's instructions to ministries and companies are basic. The recent cases put operators' exposure in their vendors and their ID handling.
The Product Desk
Three separate figures. The Times Car attack leaked data from about 6.6 million member accounts. The IDC Frontier outage hit 495 companies and local governments. Separately, the National Police Agency logged a record 123 ransomware incidents in the first half of 2026.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Times Car member accounts leaked | 6,600,000 accounts | about; leak was last month | 5 |
| Hit by IDC Frontier outage | 495 organisations | companies and local governments | 10 |
| Ransomware incidents logged | 123 incidents | first half of 2026, a record | 13 |
What happened
- The instructions, sent by the National Cybersecurity Office on Friday according to the Associated Press, cover updating security software, using strong passwords and tightening security across supply chains.
- An attack on the car-sharing service Times Car last month leaked data from about 6.6 million member accounts, the Associated Press reported.
- After SoftBank's cloud subsidiary IDC Frontier reported a ransomware attack on 7 October, the outage hit 495 companies and local governments.
- Powers under Japan's active cyber defence law took effect on 1 October, and the government says they allow "access neutralization" steps against attackers' tools.
Why it matters
- Who's exposed exposure A firm that keeps copies of driver's licenses for Japanese customers holds the same kind of data as the Times Car leak, and has a reason to ask whether it needs the copies at all.
- Who has to decide decision A vendor review for Japan-facing suppliers can start from the government's own supply-chain wording, so a procurement team has an official phrase to point at when it asks for evidence.
- What doesn't add up contradiction The instructions warn that AI is making vulnerabilities more complex, while experts told The Japan Times there is no firm evidence AI guided the recent attacks.
Next story · Security · 8h ago
Semperis survey puts threats against ransomware victims' staff at 40% of attacksConfirmed2 publishers
At 17 Nissui Logistics sites the logistics system stopped, and Ibaraki Prefecture's websites went offline, when ransomware hit their cloud provider [11]. Both were customers of the company that reported the attack, IDC Frontier [9].
Times Car members lost something different. The leak included images of driver's licenses [6]. The Financial Services Agency has since told banks to accept only ID with a chip, the FT reported, and that includes passports and My Number cards [7].
These are two separate failures, a vendor that stops and a vendor that leaks, and the government's instructions touch both through one item: supply-chain security [2]. Minister Toshiharu Furukawa said this week, "The attacks are getting increasingly sophisticated" [8].
The National Police Agency logged 123 ransomware incidents in the first half of 2026 [13], about 20.5 a month [14]. TrendAI data shared with Reuters show more incidents in the first nine months of 2026 than in all of last year [18].
Masaki Hiraoka of Blackpanda told the FT that even where attacks have not been explicitly linked to AI, the technology lets hackers launch attacks that once required time-consuming investigation beforehand [15]. "Smaller services that previously weren't worth the effort could become viable targets," he said [16].
A concrete change to a process is documented in one place so far, bank onboarding [7]. The reports on the instructions do not say whether they carry deadlines or penalties.
The sort we'd run on a Japan-facing vendor list takes two facts per vendor. The first is whether the vendor holds data about your customers or staff. The second is whether your operation stops when the vendor is down. The sort is coarse. It can be done from a contract list without new tooling.
- Holds data, outage survivable (the Times Car pattern): ask what ID documents it stores and whether chip-based ID could replace copies of licenses. - Holds no data, outage stops you (the Nissui pattern): ask for a fallback you have tested. - Both: ask both questions, and review these first. - Neither: the normal review cycle is enough.
Hiraoka's point about smaller services means the list should include vendors too small to have been reviewed before [16].
What to watch
- Whether the National Cybersecurity Office or individual ministries attach deadlines, audits or penalties to the instructions.
- Whether regulators outside banking copy the Financial Services Agency's chip-ID requirement for customer onboarding.
- Any evidence tying the recent attacks to AI use, since experts told The Japan Times none is firm today.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+30
- Incentives35
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Japan's National Cybersecurity Office sent instructions on Friday telling ministries, local authorities and companies to step up their cyber defences.
- [2]
The instructions include updating security software, using strong passwords and tightening security across supply chains.
- [3]
The instructions warn that attackers have posed as people defending against cyberattacks and that AI is making vulnerabilities more complex.
- [4]
More than 20 major Japanese companies have disclosed attacks in recent weeks.
- [5]
An attack on the car-sharing service Times Car last month leaked data from about 6.6 million member accounts.
- [6]
The Times Car leak included images of driving licences.
- [7]
Japan's Financial Services Agency has told banks to accept only ID with a chip, which includes passports and My Number cards.
- [8]
Digital Transformation Minister Toshiharu Furukawa said this week: "The attacks are getting increasingly sophisticated."
- [9]
On 7 October, the SoftBank cloud subsidiary IDC Frontier reported a ransomware attack.
- [10]
The IDC Frontier outage hit 495 companies and local governments.
- [11]
The IDC Frontier outage halted the logistics system of Nissui Logistics at 17 sites and took the websites of Ibaraki Prefecture offline.
- [12]
Deputy Chief Cabinet Secretary Yusuke Nakanishi said the government can now take 'access neutralization' steps to stop attackers using their tools; those powers came into force on 1 October under Japan's active cyber defence law.
- [13]
The National Police Agency logged a record 123 ransomware incidents in the first half of 2026.
- [14]
The 123 ransomware incidents logged in the first half of 2026 average about 20.5 a month.
- [15]
Masaki Hiraoka of Blackpanda told the FT that even if the recent attacks have not been explicitly linked to AI use, the technology is enabling hackers to carry out attacks that once required time-consuming investigations ahead of time.
- [16]
Masaki Hiraoka of Blackpanda said: "Smaller services that previously weren't worth the effort could become viable targets."
- [17]
Experts told The Japan Times there is no firm evidence that AI guided the recent attacks.
- [18]
Japan recorded more cybersecurity incidents in the first nine months of 2026 than in all of last year, according to data from TrendAI shared with Reuters.
Sources
2 independent publishers whose own reporting we read for this story.
- pcmag.comJapan Declares Cybersecurity Emergency, Experts Nod to AI | PCMag
1 article · October 10, 2026
- thenextweb.comJapan steps up cyber warnings as data leaks hit millions of customers
1 article · October 12, 2026
Topics and entities
Topics
Entities
- Financial Services Agency (Japan)
- National Police Agency
- Times Car
- Toshiharu Furukawa