Ransomware, breaches, outages and cyber policy in Japan, built from Japanese-language primary sources and explained for security teams, analysts and companies operating in Japan.
Sagawa Express puts its breach at 53 million records; Japan pauses websites over php2shell; AI attack tools are confirmed on both sides; email delivery services are hit three times in a month; and GMO is extorted over an FX trading VPS breach.
Japan's trade minister says IPA will set up a team of 'off-white hackers' in November to attack systems harder than attackers do, using AI. It follows a ruling party proposal calling the breach wave the 'eve of a cyber emergency'. What was announced, and the questions it leaves.
IncidentsUpdated
Attackers broke into GMO Internet's Onamae.com Desktop Cloud, a VPS service for MT4/MT5 trading, used saved logins to trade in customers' FX accounts, and are now extorting GMO. GMO will pay every user ¥5,000, compensate trading losses, rebuild the service, and has asked the government to use active cyber defense.
IncidentsUpdated
Capcom says attackers got into CAPCOM ID, the account players use for its online games, exposing email addresses and login details for 11,774,247 accounts worldwide, and changing the passwords of 196. Games are unaffected.
Digital Arts, maker of the i-FILTER and m-FILTER security products sold to Japanese companies, government bodies and schools, says stolen operations credentials let attackers into the environment running six of its cloud services. It found the traces with an AI-assisted review on October 9, 2026.
Attackers who hit Trade Works, the vendor that runs Iwai Cosmo Securities' online trading system, placed orders in seven customers' accounts on October 14, 2026 without logging in as them. Japan's top government spokesperson says the FSA has asked for a cause analysis.
ThreatsUpdated
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that allow unauthenticated remote code execution. Before the release, Japanese services from pixiv to childcare app Codmon switched off, and Prime Minister Takaichi called pausing websites an effective way to cut risk.
IncidentsUpdated
NEC says a company it uses for system development and maintenance was hacked in late September 2026, and its legitimate accounts were used to break into NEC customers' systems and encrypt servers. Files in a cloud storage NEC used to share project information also leaked.
ThreatsUpdated
GMO Cybersecurity by Ierae says attackers behind Japan's breach wave used ARTEX, an open-source AI penetration testing tool from China, against about 20 Japanese companies, eight of which have already disclosed breaches. CrowdStrike saw the same tool in attacks on South Korean banks.
Qilin became a household name in Japan after the Asahi attack. In 2026, a group that grew out of Qilin's own affiliates, The Gentlemen, has listed more Japanese organizations than any other. What the data shows, and why the name matters less than the way in.
IncidentsUpdated
Attackers reached the cloud environment of Studio, a Japanese no-code website builder, and the keys that decrypted its customers' form submissions and API keys. Luup, Raksul and Saitama Prefecture are among the customers now disclosing. The PPC now lets them report jointly through Studio.
AnalysisUpdated
Japan's 2026 breach wave hit app after app, and ID images kept for years. Why the data that companies never collected, or deleted on time, is the one defense that held.