Japan declared a cybersecurity emergency after a sharp rise in cyberattacks raised concerns about the scale of damage hackers can inflict using artificial intelligence (AI).
More than 14 million citizens have had personal information exposed in the wider wave of breaches, while a ransomware attack on cloud provider IDC Frontier disrupted access to data across 495 organisations.
September alone recorded 86 cyber incidents, 37% more than July. Japan has recorded more than 500 incidents so far in 2026, exceeding the 473 cases reported in 2025 & the previous annual record of 503 in 2024.
Also Read: OpenAI AI Agent Hacks Australian Government Website for the First Time: What the Breach Means
Japan Orders Government Agencies and Businesses to Strengthen Cybersecurity
Masaaki Taira, head of Japan’s National Cybersecurity Strategy Headquarters and a senior artificial intelligence policy official of the Liberal Democratic Party, convened an emergency meeting on 9 October.
Taira warned that AI allows a small number of attackers to target far more systems than before. Cybersecurity Minister Toshiharu Furukawa described the situation as “extremely critical”.
Japan’s National Cybersecurity Office issued security instructions to government ministries, with guidance to be passed on to local authorities and private-sector organisations. The ruling party also called for stronger cooperation between government and industry.
Also Read: AI Agents Tried to Hack Canadian Government Website, Transluce Reports
IDC Frontier Ransomware Attack Hits 495 Organisations
The emergency followed a ransomware attack on 8 October against IDC Frontier, a SoftBank-owned cloud services provider. The incident disrupted access to data held by 495 client organisations.
Japan’s railway operator JR East and its credit card subsidiary View Card reported that up to 6.09 million records may have been accessed through email services hosted on the affected infrastructure.
JR Kyushu reported the potential exposure of another 1.3 million email records.
Tokyo Metro disclosed access to email addresses belonging to 59,000 Metpo loyalty scheme members.
Daiwa Securities reported that a compromised contractor server may have exposed up to 220,000 records. Retailers Lawson and FamilyMart also reported data breaches.
IDC Frontier said data restoration would depend on customer-held backups, highlighting the risks of relying on a shared cloud provider.
Also Read: North Korean Hackers Develop AI Tools to Automate Cyberattacks: Report
Times Car Breach Exposes 6.6 Million Members’ Data
A separate breach at Times Car, operated by Park24 Group, affected information associated with 6.6 million members. Disclosed on 25 September, the incident involved names, addresses, dates of birth, phone numbers, email addresses and driving licence images.
Japan’s Financial Services Agency subsequently warned banks against accepting driving licences as the sole form of identity verification, given the potential exposure of identity documents.
Also Read: Cyber-Suraksha.ai: SEBI’s Big Move Against AI-Based Cyberattacks
AI Raises the Stakes as Japan Activates New Cyber Law
Cybersecurity experts say AI can automate reconnaissance and generate convincing Japanese-language phishing messages, reducing the time and effort required to target organisations. No group has formally claimed responsibility for the attack wave, and Japanese authorities have not officially attributed the incidents to a particular state or criminal group.
Japan activated its Active Cyber Defence operations on 1 October under legislation enacted in May 2025.
The framework allows authorities, including the National Police Agency and Self-Defence Forces, to access & neutralise servers used in serious cyberattacks. The action is subject to approval and oversight.
It also introduces mandatory incident-reporting requirements.
Japan’s response will test whether stronger cyber laws and reporting requirements can keep pace with AI-assisted attacks. The breach at IDC Frontier also raises a wider question for businesses: whether concentrating data with a single cloud provider creates risks that conventional security measures cannot adequately contain.
Samarjit Kaur is a journalist and communications professional covering technology & emerging digital trends. With a focus on clarity and context, she reports on developments shaping industries and governance. When not reporting, she chooses to plug-in and relax on her playlists and plan her next bucket-list trips!
