Japan Declares a Cyber Emergency as Breaches Hit More Than 20 Major Companies (2026)

Japan's government says the country is in a state of emergency in cyberspace. The ruling party convened an emergency meeting of the National Cybersecurity Strategy Headquarters on Friday, October 9, after a run of attacks on rail operators, car-sharing services, karaoke chains and the police. Masaaki Taira, who heads the headquarters, declared that Japan was in "a state of emergency in cyber space"; cybersecurity minister Toshiharu Furukawa called the situation "extremely critical". 1 Furukawa told reporters: "Everyone must become vigilant about protecting your own information yourself." 2

More than twenty major Japanese companies, from barbecue chains to discounters, have reported attacks in recent weeks and warned that tens of millions of pieces of customer data may have leaked. 1 The companies named in the reporting include Lawson convenience stores, the karaoke chain Daiichikosho, SoftBank and Daiwa Securities. 2 JR East said around 4.03 million email addresses leaked from its group's Viewcard credit-card service, and information from email addresses to email logs on about 1.67 million accounts of its Ekinet booking service was affected; Bookoff said up to 6.43 million accounts were exposed through a subsidiary's member data system; and Times Car said about 6.6 million accounts were exposed, including images of 1.6 million driver's licences. 3

The licence photographs are the part with a price on it. The Financial Times reports that experts estimate the images may now be on sale on the dark web for as little as ¥25, about 15 US cents, each, and that the leaks at JR East, local governments and hundreds of other businesses were linked to a ransomware attack disclosed on Thursday by IDC Frontier, a SoftBank subsidiary that provides cloud services. 1 The travel agency H.I.S. said passport data leaked at the end of last year, and that it took time to grasp the extent of the leak. 3

Security firms put the falling cost of an attack on AI. Nobuo Miwa, president of the security company S&J Corp, told Reuters that "AI doesn't get tired" and that "Japan is essentially being subjected to carpet bombing". CrowdStrike says a 26-year-old China-based attacker suspected of being behind the incidents at South Korean banks probably could not have carried out the campaign without AI — he used a Chinese-developed AI agent and Anthropic's Claude Code — and Adam Meyers, the company's senior vice-president for counter adversary operations, said that while the hacker's capabilities "were not terribly sophisticated, they were effective". John Hultquist of Google Threat Intelligence Group: "At this point, we can assume that all threat actors are using AI in some capacity and their operations have benefited." 4 Masaki Hiraoka of the security firm Blackpanda says the wave of attacks in Japan itself has not been clearly linked to AI. 1

The incident numbers are climbing. TrendAI's data, cited by Reuters, shows Japan recorded more cyber incidents in the first nine months of 2026 than in all of 2025, reaching 86 in September — about 18% up on August and 37% up on July. 4 The Yomiuri newspaper and the security firm Trend Micro put Japan at more than 500 cybersecurity incidents reported so far this year, against 473 in 2025 and 503 in 2024. 5 South Korea, where regulators have begun their own review, reported 1,236 cyber incidents in the first half of 2026, up 20% on the year, with DDoS reports up 56.7% and ransomware up 76.8%. 4

The government's answer so far is advice rather than enforcement. The Financial Services Agency urged lenders on Friday to shift as quickly as possible to accepting only forms of identification containing chips, such as passports or MyNumber national identity cards, after the Times Car leak. 1 Ministries will distribute cybersecurity instructions to local public bodies and private companies — keep protection updated, use strong passwords, and watch for attackers who pose as helpers. 2 Japan's National Police Agency says 53 companies in Japan have been targeted by the Qilin ransomware group, with victims spanning manufacturing, services, construction, hospitals and schools; the agency has not disclosed their names. 6 No published account attributes the wider Japanese wave to anyone, nobody has been charged over the Japanese breaches, and no penalty has been announced.

"State of Emergency" is an original rap song and music video built from those facts.

Visual material: the Tokyo skyline at night, the rainy Tokyo street, the Shibuya crossing crowd, the empty office, the laptop keyboard, the phone held in the dark, the network switch and the data-centre aisles are free-stock photographs under the Pexels License, which requires no credit; the Kasumigaseki government building is a free-stock photograph from Pakutaso, whose terms require no credit; the moving shots of Tokyo at night, the Shinjuku back street in the rain and the server aisle are free-stock video under the Pexels License and the Pixabay License, neither of which requires credit; the two page images are screenshots of the Kyodo News and NBC News stories linked above; everything else on screen is drawn for this episode.