Japan Declares Cyber Emergency

Japan has declared a cybersecurity state of emergency after dozens of companies fell victim to a relentless wave of ransomware attacks. Japan's National Police Agency recorded at least 53 companies affected by the attacks, which lock and hold victims' data hostage.

In September 2026 alone, 86 cybersecurity incidents were recorded — up about 18 percent from August and 37 percent from July. Data from security firm TrendAI shared with Reuters shows the number of incidents in Japan during the first nine months of 2026 has already surpassed the total for all of 2025.

Two companies have confirmed they were victims. Second-hand retailer Bookoff Group said more than 6 million customer data records may have leaked, while East Japan Railway (JR East) reported 1.67 million email addresses exposed. Car rental company Times Car reported around 6.6 million accounts at risk after users' driver's license photos leaked. Other companies named include convenience store chain Lawson and securities firm Daiwa Securities.

"The Condition Is Very Critical"

Japanese Cybersecurity Minister Toshiharu Furukawa described the situation as extremely critical. "The situation is extremely critical," Furukawa said at a meeting of the National Cybersecurity Strategy Headquarters (NCSH) on Friday (9/10/2026). NCSH chief Masaaki Taira called the situation a state of emergency.

The Japanese government is asking ministries, local governments, companies, and the public to strengthen digital security measures. Japan's financial services regulator even warned banks to stop accepting driver's licenses as proof of identity for prospective customers — a fallout from the driver's license photo leak in the Times Car incident.

Japanese police also arrested a 28-year-old Russian national in Osaka in May 2026 on suspicion of being a core member of the international ransomware group Qilin; the suspect was handed over to Germany in early October 2026. Qilin had previously claimed responsibility for an attack on beverage maker Asahi Group Holdings.

South Korea: 16 Financial Institutions Infiltrated

A similar threat hit South Korea. At least 16 financial institutions suffered system intrusions between late September and early October 2026. President Lee Jae Myung ordered a full-scale investigation on October 4, 2026, after receiving reports of data leaks from a number of financial institutions.

"He instructed authorities to handle this matter seriously," presidential spokesperson Kang Yu-jung said, as reported by Reuters. On the same day, the Financial Services Commission (FSC) held an emergency meeting moved up from its October 7 schedule after additional breaches were discovered.

FSC Chairman Lee Eog-weon ordered a comprehensive audit of internet-connected IT assets and restrictions on external access. Data submitted to parliament showed attack traffic originated from IPs in several countries, including the US, Japan, Singapore, Vietnam, and the UK. The opposition People Power Party called for an investigation into suspected North Korean involvement.

Alleged Role of AI in Attack

A number of cybersecurity experts suspect this wave of attacks has been exacerbated by artificial intelligence (AI), although there is no evidence yet that all the attacks involved it. Blackpanda cybersecurity company director Masaki Hiraoka said AI makes the attack process far more efficient while also increasing its chances of success.

S&J security company president Nobuo Miwa believes AI allows foreign hackers to overcome language barriers. "AI never gets tired... In my view, Japan is essentially being subjected to a massive bombing campaign," Miwa said.

The Japanese government is urging the public not to use the same password across multiple services, to enable multi-factor authentication, and to be wary of suspicious emails and messages — as leaked data risks being exploited for identity theft and further fraud.