Japan's cyber incidents, threats and policy — in English.
Ransomware, breaches, outages and cyber policy in Japan, built from Japanese-language primary sources and explained for security teams, analysts and companies operating in Japan.
Japan's government blames this year's breach wave on unpatched flaws, misconfigurations and weak development security, at companies and their contractors. Its emergency package sets November deadlines for new teams, promises a Japanese KEV list and attacker infrastructure disclosures, and moves online identity checks from ID photos to the chip in My Number cards. For companies, it works mostly through requests and support.
The government compiles an emergency package and police open a nationwide joint investigation; GMO holds its first press conference; Arara Message's breach reaches 81 million addresses and its clients start counting; Nojima, Iris Plaza and @cosme join the list; and SEGA's arcade network goes dark.
After unauthorized access to servers behind ALL.Net and Aime, the network and player card system that connect arcade machines across Japan, SEGA Fave stopped both on November 1. Five days later, cabinets from Initial D to Taiko no Tatsujin and Mario Kart were dark or limited, tournaments were cancelled, and there was no restart date.
Ryohin Keikaku, which runs MUJI, first said only email addresses, birth dates and gender of app users may have leaked. Its second report widened that to online store customers, about 520,000 names and addresses, and full card numbers of about 1.09 million MUJI Card holders, received from Credit Saison for a points scheme that stopped using them in 2021 but never deleted.
Attackers took up to 5.5 million records from the system Prestige International's subsidiary uses to take roadside assistance calls for insurers and car leasing companies: names, addresses, plate and chassis numbers, accident details and some bank account data. Sony Assurance, AXA, ENEOS and Nippon Car Solutions have told their own customers, each with different details.
GMO GlobalSign's single sign-on service GMO Trust Login stored files from administrators' bulk operations in the same public storage area it used to serve logos. Anyone could list and download them from November 2017 to September 2026. Third parties took files covering 45,030 people at 2,492 companies. The storage was outside the scope of its security assessments.
GMO Internet answered the extortion of its Onamae.com Desktop Cloud customers with a public campaign: a request for active cyber defense, a CEO blog, a $1 million bounty with daily tip counts and a stream of social media posts. Its customer advice was good. The spectacle around it was, in our view, the worst way to respond to people who need attention.
With 50 breaches of a million records or more disclosed in Japan this year, many people have now received a notice. Based on the IPA's new guidance, here is what each kind of leaked data means, what to do about it, the scams that follow, and the rights Japanese law gives you.
Japan's Personal Information Protection Commission received 830 breach reports caused by unauthorized access in the first half of October alone, and is bringing forward the first major update of its security measures guideline since 2016: phishing-resistant MFA, zero trust, EDR, log retention and containment. Public comments close November 27.
GMO's attackers publish data and the government asks for site blocking; MUJI discloses up to 27 million app records; Amadeus exposes JAL and ANA bookings; email delivery and other vendors keep falling; and PHP2Shell is used to root firewalls.
Japan's communications ministry asked telecom carriers to block the site where GMO's attackers published customer data. Blocking is rare in Japan because it touches the constitutional secrecy of communications. We explain the precedents, from child abuse images in 2011 to manga piracy in 2018, and what is new this time.
Japan Airlines, ANA, Korean Air and Asiana say booking records were viewed through unauthorized access to Amadeus, the passenger service system they all use. JAL says about 92,000 passengers were affected, 2,000 with passport numbers, and that access traces go back to August 2023.