Japan Declares Cyber Emergency
Japan's National Cyber Security Strategy Headquarters head Masaaki Taira announced a "cyber emergency" due to a surge in cyberattacks, leading to over 20 major companies reporting data breaches.
Cybersecurity Minister Toshiharu Furukawa described the situation as "extremely serious." Affected companies include convenience store Lawson, rental car company Times Car (approximately 6.6 million account data and driver's license photos), railway operator JR East (about 1.67 million customer emails), brewer Asahi (ransomware caused factory shutdowns and beer shortages), wholesaler Askul, Nikkei News, Tokyo Metro, and barbecue chain Yakiniku King (around 10 million customer records).
SoftBank's cloud service IDC Frontier was hit by ransomware, affecting about 495 organizations. Since 2026, over 500 cybersecurity incidents have been recorded, surpassing the total of 473 in 2025 and 503 in 2024, with 86 incidents reported in September alone. Some reports indicate that over 14 million citizens' personal information has been compromised.
Japan officially launched the "Proactive Cyber Defense Law" on October 1, allowing police and the Self-Defense Forces to take preemptive measures against hostile servers. The Financial Services Agency has requested banks to stop using driver's licenses as the sole form of identification for account openings, instead opting for chip-enabled documents.
Analysts point out that AI lowers the threshold for attacks, aids foreign hackers in bypassing language barriers, and accelerates vulnerability scanning. The government has issued mandatory security directives to various ministries, requiring them to relay this information to local governments and private operators.
Capital and operational resources are shifting from daily business to security reinforcement and compliance, driven by the wave of attacks and the new law coming into effect. Security service providers and chip ID stakeholders benefit, while affected companies and traditional verification processes face pressure.
Source: Public Information
ABAB AI Insight
Japan has long relied on passive defense. The Proactive Cyber Defense Law was passed in 2025 and took effect on October 1, 2026, allowing police and the Self-Defense Forces to access and neutralize servers before threats materialize, previously relying only on post-event responses and information sharing.
On the capital front, the government is investing mandatory directives and public-private collaboration mechanisms into critical infrastructure and enterprises, motivated by the need to address the scale of AI-accelerated attacks, shifting resources from decentralized self-protection to centralized monitoring and proactive capabilities.
Similar cases include the U.S. and Europe strengthening proactive defense legislation after major data breaches, as well as countries like Singapore imposing mandatory reporting requirements for critical infrastructure. Japan is currently transitioning from passive compliance to proactive neutralization, facing annual incidents exceeding historical peaks.
This is essentially a regulatory change: the new law shifts cyber defense from post-event reporting to proactive neutralization, with the mechanism being that AI reduces attack costs, rendering traditional passive models ineffective, forcing the government to authorize police and Self-Defense Forces intervention and mandating companies to report, thereby compressing the attack window.
ABAB News · Cognitive Laws
- When attacks accelerate, defense must be proactive.
- The larger the data scale, the broader the single point of failure.
- AI lowers the threshold, making traditional defenses ineffective.