Japan's government did not invoke emergency powers. It did something rarer: a minister and the ruling party's cyber chief said, in public and within a day of each other, that the country's run of breaches had become critical, an “emergency in cyberspace”. We started counting on 2 October. By 6 October the year's largest breach notices added up to more than Japan's population. The statements followed on 8 and 9 October.
What was said, by whom, and when
- 6 October. Toshiharu Furukawa, minister for digital transformation and for cyber security, used his press conference to ask the public to take three steps: stop reusing passwords, turn on multi-factor sign-in, and open official apps or sites instead of links in messages. ITmedia NEWS (Japanese)
- 8 October. The National Cybersecurity Office called an urgent meeting of all ministries. Furukawa described the situation as “extremely critical” (大変危急の状況). Ministries were told to send information on damage and attack methods to the Office, and to review how they handle data so that leaked information cannot be misused. ANN via KSB (Japanese) · Impress Watch (Japanese)
- 8 October. JPCERT/CC issued alert JPCERT-AT-2026-0030 on the wave of unauthorised access, with indicators for some of the cases. JPCERT/CC (Japanese)
- 9 October. The National Cybersecurity Office published an alert for organisations that hold large amounts of personal data, in three areas: web systems, supply chains, and data management. Its message to management was that this is “no longer a problem for the IT department alone”, and that any organisation could be attacked at any time. IPA, the communications and economy ministries and the Financial Services Agency issued related alerts the same day. INTERNET Watch (Japanese) · ITmedia NEWS (Japanese)
- 9 October. Masaaki Taira, a former digital minister who heads the Liberal Democratic Party's National Cybersecurity Strategy Headquarters, opened its meeting by saying it “could be called an emergency in cyberspace” and that the whole government needed to act. He pointed to AI making attacks more efficient and automated, and to attackers reaching well beyond the critical-infrastructure operators that policy has focused on. The party asked the government to strengthen public-private cooperation, and Taira pointed to sensors that detect intruders before personal data is taken. Yomiuri via Yahoo! Japan (Japanese) · Nikkei (Japanese)
Two clarifications for readers outside Japan. First, Taira's headquarters is a body of the ruling party, not of the government; some English reports describe him as the head of a government body. Second, “emergency” here is a description, not a legal status. No emergency powers were invoked; the practical measures so far are alerts, information pooling at the National Cybersecurity Office, and requests to companies.
The context matters too. A government document dated 30 September says the new law on active cyber defence was coming into force on 1 October, with incident reporting to the government due to become mandatory for critical-infrastructure operators. National Cybersecurity Office (Japanese, PDF) Many of the organisations in this autumn's notices are retailers, travel and transport companies, universities and service providers, not critical infrastructure. That is the gap Taira was pointing at.
What our count showed first
We did not predict a statement. We counted notices, and the count told the same story before the statements did.
| Date | What we published | What officials said |
|---|---|---|
| 2 October | Our review of Japan's breach year: the 25 disclosures of 100,000 or more, sorted by cause rather than size | |
| 6 October | The 30 largest notices of the past 12 months add up to 131.57 million, more than Japan's 122.65 million people. We retitled the review: “Japan has 123 million people…” | Furukawa asks the public to take three steps |
| 8 October | Every notice from 10 August to 8 October: 153, of which 92 were attacks putting personal data at risk. The 38 largest of the year now add up to 147.20 million | Ministries' emergency meeting: “extremely critical”. JPCERT/CC alert |
| 9 October | National Cybersecurity Office alert. LDP headquarters: “an emergency in cyberspace” |
Figure 1. Our count and the official response, 2–12 October 2026. Original graphic for this article.
The full list, by cause and with every source, is in our 60-day review. Three findings from it line up with what officials are now saying:
- The leaks are broad, not concentrated. 92 attacks put personal data at risk in 60 days, across retail, travel, finance, education and local government. That is what Taira meant by attackers moving beyond critical infrastructure.
- Suppliers and platforms multiply one breach into many notices. A single contractor or cloud platform sat behind several companies' notices, most visibly the IDC Frontier ransomware attack that hit 495 customers. The National Cybersecurity Office's second area, supply chains, is aimed at exactly this.
- Most notices do not say how the attacker got in. 74 of the 153 do not disclose the method. Where they do, the largest leaks came through customer apps and APIs, analytics tools and suppliers, which map to the Office's first and third areas: web systems and data management.
Is AI behind it?
Officials and experts quoted in the international coverage think AI is making attacks cheaper:
- Masaki Hiraoka, managing director for north-east Asia at Blackpanda, told the Financial Times that even if this wave has not been explicitly linked to AI, the technology lets attackers skip reconnaissance that once took time, and that “smaller services that previously weren't worth the effort could become viable targets”. PCMag via Yahoo
- Nobuo Miwa, president of the Tokyo security firm S&J, told Reuters that AI “doesn't get tired” and that Japan is “essentially being subjected to carpet bombing”. He also suggested AI tools may be lowering the language barrier that used to protect Japanese companies. Reuters via Insurance Journal
- Reuters reported TrendAI figures showing Japan recorded more publicly disclosed cyber incidents in the first nine months of 2026 than in all of 2025, with 86 in September alone, about 18% more than in August and 37% more than in July.
Our assessment. The pattern fits automation: many medium-sized targets, many different routes in, and attacks against services that a human operator would not have found worth the time. But no organisation in the 153 notices we logged said AI was used against it, and none of the official statements cites a specific case. Treat AI as an accelerant, not the cause. The doors attackers are walking through are the same ones as before: exposed apps and APIs, suppliers with access to data, reused passwords.
The attacker's playbook: why “carpet bombing” works
This is how a red team would run a campaign at the scale the notices suggest, mapped to MITRE ATT&CK. It is a model, not an attribution.
| Step | What it looks like at scale | ATT&CK |
|---|---|---|
| Find targets | Scan whole address ranges and search engines for login pages, admin panels, analytics tools and APIs; let a model triage what is worth a second look | T1595 Active Scanning; T1593 Search Open Websites/Domains |
| Get in | Exploit a known flaw in an exposed app or appliance; reuse leaked passwords; abuse an API that returns other customers' data | T1190 Exploit Public-Facing Application; T1078 Valid Accounts |
| Go through the supplier | Use a contractor's access, or attack the platform that hosts many customers at once | T1199 Trusted Relationship |
| Take the data | Pull records in bulk from databases, storage and exports | T1530 Data from Cloud Storage; T1119 Automated Collection |
| Get paid | Sell the data, extort, or encrypt | T1567 Exfiltration Over Web Service; T1486 Data Encrypted for Impact |
| Reuse the leak | Use the names and emails in phishing that names the breached brand | T1566 Phishing |
The economics are the point. When reconnaissance and triage are cheap, the attacker does not need a valuable target; it needs many reachable ones. The “smaller services” in Hiraoka's warning are the long tail of the 153 notices.
The defender's playbook
1. Work through the government's three areas
| Area named on 9 October | What to check this week | Evidence to keep |
|---|---|---|
| Web systems | Inventory every internet-facing app, API, admin panel and analytics tool; patch or take offline what is not needed; check that APIs return only the caller's own data | Asset list with owners, patch dates, test results |
| Supply chains | List every supplier that holds or can reach your customers' data, including mail, hosting and cloud platforms; confirm how they would tell you about a breach | Supplier list, contract clauses, contacts |
| Data management | Keep less, encrypt what you keep, and watch for bulk reads and exports | Retention rules, alert rules, last test date |
2. Detect reconnaissance at machine speed
- Alert on breadth, not just volume. One source requesting hundreds of different paths in ten minutes, most of them missing, is a scanner. Queries below.
- Alert on bulk reads. The 60-day review has a query for unusual bulk downloads, and our Lawson analysis one for a single caller reading many customer records.
- Use JPCERT/CC's indicators. Our 60-day review turns the 8 October alert into KQL, SPL, Sumo Logic and LogScale queries.
3. Prepare to report and to talk
- Know your obligations. Personal-data leaks go to the Personal Information Protection Commission; critical-infrastructure operators are due to report incidents to the government as well under the new law.
- Brief management. The National Cybersecurity Office's own words, “no longer a problem for the IT department alone”, are a ready opening line for a board paper (template below).
- Brief staff on phishing that names breached brands; the phishing response playbook covers clean-up.
4. Which teams should act
| Team | Exposure to review | Next step | Evidence needed |
|---|---|---|---|
| IT Operations | Internet-facing systems | Inventory, patch, remove what is unused | Asset list, patch log |
| SIEM / SOC | Web, API and data-store logs | Schedule the reconnaissance and bulk-read queries | Query schedule, alert routing |
| Third-party Risk | Suppliers holding data | Send questions; confirm notification paths | Written answers |
| Legal / Privacy | Reporting duties | Confirm who reports to whom, and when | Decision tree, contacts |
| Email Security | Lures naming breached brands | Run brand-lure mail queries from our earlier articles | Message list, blocks |
Hunting: machine-speed reconnaissance against your public sites
No campaign-wide indicators have been published. JPCERT/CC's alert covers some cases; its indicators are in our 60-day review. The queries below look for the behaviour that cheap, automated reconnaissance produces on your own web servers.
All queries are illustrative and were not run against live data. Table and field names were checked against vendor documentation on 13 October 2026 (JST). Expect noise from search engines, uptime monitors and your own vulnerability scanners; list them as exceptions.
1. One source walking hundreds of paths, mostly missing. Microsoft Sentinel, IIS logs in W3CIISLog.
// Illustrative; not run against live data. Microsoft Sentinel, W3CIISLog (IIS web servers). Adapt the column names for other web or WAF logs.
// Machine-speed reconnaissance: one source requesting many different paths on a public site within ten minutes, most of which do not exist.
// A person browsing touches a handful of pages. A scanner, AI-assisted or not, walks hundreds.
let Since = ago(7d);
let Sites = dynamic(["REPLACE_WITH_SITE_NAME"]);
let OwnScanners = dynamic(["REPLACE_WITH_YOUR_SCANNER_IP"]);
W3CIISLog
| where TimeGenerated > Since
| where sSiteName in (Sites)
| where not(cIP in (OwnScanners))
| summarize Requests = count(), DistinctPaths = dcount(csUriStem), NotFound = countif(toint(scStatus) == 404),
ServerErrors = countif(toint(scStatus) >= 500), Agents = make_set(csUserAgent, 5)
by cIP, bin(TimeGenerated, 10m)
| extend NotFoundRatio = round(todouble(NotFound) / Requests, 2)
| where DistinctPaths > 100 and NotFoundRatio > 0.5
| order by DistinctPaths desc
| take 500
2. The same check in Splunk for web or proxy logs with CIM-style fields (src, uri_path, status).
index="REPLACE_WITH_WEB_INDEX" sourcetype="REPLACE_WITH_WEB_SOURCETYPE" earliest=-7d
| bin _time span=10m
| stats count AS requests dc(uri_path) AS distinct_paths count(eval(status=404)) AS not_found count(eval(status>=500)) AS server_errors values(http_user_agent) AS agents BY _time src
| eval not_found_ratio=round(not_found/requests,2)
| where distinct_paths > 100 AND not_found_ratio > 0.5
| sort 0 - distinct_paths
Download the examples: reconnaissance KQL · reconnaissance SPL.
Other platforms. Sumo Logic, web servers writing the Apache or Nginx combined log format:
_sourceCategory="REPLACE_WITH_WEB_SOURCE_CATEGORY"
| parse regex "^(?<src_ip>\S+) \S+ \S+ \[[^\]]+\] \"\S+ (?<path>\S+) [^\"]*\" (?<status>\d{3})"
| if(status = "404", 1, 0) as missing
| timeslice 10m
| count as requests, count_distinct(path) as distinct_paths, sum(missing) as not_found by _timeslice, src_ip
| where distinct_paths > 100 and not_found / requests > 0.5
| sort by distinct_paths
No result does not mean no one is looking. Reconnaissance spread across many addresses stays under any per-source threshold; lower it, or group by network range, if your sites are small. W3CIISLog table
Copy-paste templates
Replace everything in [square brackets]. Have Legal or Privacy review anything that leaves the company.
Self-check against the government's three areas
Title: Self-check against the National Cybersecurity Office alert of 9 October 2026
Context: after a run of data breaches, the minister responsible for cyber security called the situation "extremely critical" on 8 October, and the National Cybersecurity Office asked organisations holding personal data to act in three areas. Please complete this check by [date].
A. Web systems
1. List every internet-facing system: websites, apps, APIs, admin panels, analytics tools, remote-access devices. Owner for each?
2. Which are not needed? Date taken offline.
3. Patch status of the rest; any known exploited flaws outstanding?
4. For each API that returns personal data: tested that one customer cannot read another's data? Date and result.
B. Supply chain
5. Every supplier that holds or can reach our customers' data, including mail delivery, hosting and cloud platforms.
6. For each: contract clause on breach notification, named contact, last confirmation date.
C. Data management
7. Personal data we hold that we no longer need, and the deletion date.
8. Alerts for bulk reads, exports and unusual downloads: in place? Last tested?
9. Access logs kept for how long, and where?
Owner: [name]. Due: [date]. Report to: [security lead / management].
Five-line briefing for management
1. What happened: after more than 150 breach and incident notices in Japan in two months, the cyber security minister called the situation "extremely critical" (8 Oct 2026) and the ruling party's cyber headquarters called it "an emergency in cyberspace" (9 Oct). The National Cybersecurity Office asked organisations to act on web systems, suppliers and data.
2. Why it matters to us: attackers are now reaching mid-sized and smaller organisations, not only critical infrastructure; the government says this is a management issue, not only an IT one.
3. Our position: internet-facing systems inventoried [yes / by date]; suppliers holding customer data listed [number]; bulk-read alerts [in place / planned].
4. Actions under way: self-check against the three areas due [date]; reconnaissance and bulk-read queries scheduled; staff phishing warning [date].
5. Decisions needed: [e.g. budget to retire or patch exposed systems; require suppliers to confirm breach notification terms]. Next update: [date].
What remains unknown
- Whether the attacks are linked. No single group has been named, and the routes in vary.
- How much AI is involved. Officials and experts suspect it; no notice or official statement cites a specific case.
- What “emergency” will lead to. So far, alerts and information pooling. Whether new rules, funding or reporting duties follow is not yet clear.
- How incident counts compare. TrendAI, JPCERT/CC and our own list count different things. Ours counts public notices from organisations in Japan; others count incidents differently.
Sources and updates
- ITmedia NEWS: minister Furukawa asks the public to take three steps (Japanese), 6 October 2026
- ANN via KSB: ministries meet; minister calls it “extremely critical” (Japanese), 8 October 2026
- Impress Watch: urgent meeting of ministries; information pooled at the National Cybersecurity Office (Japanese), 8 October 2026
- JPCERT/CC: JPCERT-AT-2026-0030 (Japanese), 8 October 2026
- INTERNET Watch: National Cybersecurity Office alert (Japanese), 9 October 2026
- ITmedia NEWS: the alert's three areas (Japanese), 9 October 2026
- Yomiuri via Yahoo! Japan: LDP headquarters calls it an emergency in cyberspace (Japanese), 9 October 2026
- Nikkei: government alerts companies; LDP asks for public-private cooperation (Japanese), 9 October 2026
- Reuters via Insurance Journal: South Korea, Japan buffeted by hacks as AI lowers bar for cybercriminals, 9 October 2026
- PCMag via Yahoo: Japan declares cybersecurity emergency, experts nod to AI
- National Cybersecurity Office: meeting on bringing the active cyber defence law into force (Japanese, PDF), 30 September 2026
- Microsoft Learn: W3CIISLog table
Our earlier coverage: 60-day review of Japan's breach notices · IDC Frontier IDCF Cloud ransomware · Lawson ID · H.I.S. Thailand.
13 October 2026: first published. Statements and reports were checked on 13 October (JST). We could not reach the Financial Times article directly; Hiraoka's comments are quoted as reported by PCMag.