Cyberattacks escalate in Japan

Cyberattacks targeting major Japanese companies have increased significantly in recent weeks, leading government authorities to issue urgent demands for fixes and stricter data handling practices. The National Cyber Security Agency released a warning on October 9, 2026, signaling a new phase of heightened threats.

Government response intensifies

Following the warning, multiple government bodies, including the National Police Agency and three ministries, have issued directives to companies. These instructions focus on rapid security improvements, better oversight of subcontractors, and reduced data retention periods. For the first time, these directives are directed at company executives rather than just IT specialists.

Data breaches reveal scale of attacks

Since the beginning of 2026, cyberattacks in Japan have resulted in the exposure of millions of customer accounts. Trend Micro, a cybersecurity firm, reported 600 confirmed intrusions by the end of September 2026, surpassing the 593 recorded in 2025. These breaches span various sectors, including retail, transportation, and food services.

Major companies affected

Several well-known companies have been hit hard by these attacks. Lawson, a major supermarket chain, disclosed a breach affecting over 2.15 million customer accounts. The Times Car car-sharing service reported the largest single breach, with 6.6 million affected accounts, many containing sensitive personal information like driver’s licenses. A restaurant chain also leaked 10.78 million member records, highlighting the widespread nature of the attacks.