Key takeaways

  • On November 6, Japan's Cybersecurity Related Ministers' Meeting compiled a Cybersecurity Emergency Countermeasures Package. We read the full text: an 8-page main document and a 19-page list of measures.
  • Its diagnosis is blunt. In many of this year's breaches, it says, basic measures were not in place, at the organization or at its contractors: known vulnerabilities left unpatched, misconfigured websites and weak security in application development. AI, it adds, means such gaps are now exploited faster and at scale.
  • The deadlines are short. An outreach team that contacts organizations at risk and an IPA "top-gun" penetration testing team are due this month. Threat hunting manuals and detection tools, and measures against domestic devices abused as stepping stones, are due by the end of the year.
  • The government promises to send more information back to defenders. Examples include a Japanese list of vulnerabilities exploited in Japan ("Japanese KEV"), cross-case analysis of attack techniques, and publication of attacker infrastructure. A dedicated analysis unit, however, only starts in April 2027.
  • It pushes identity checks that read the IC chip in My Number cards, instead of uploaded ID photos, and hardens the government's Digital Authentication Service, including an age check that shares only an age or age range, not a date of birth.
  • For private companies, the package works mostly through requests and support; rules would come from the privacy regulator's guideline revision and a law amendment the Prime Minister asked ministers to study. The carrier "access suppression" measure that press reports call blocking is still only to be studied.

What the package is#

On October 26, Prime Minister Sanae Takaichi ordered an emergency package in response to the breach wave that has hit Japanese consumer services this autumn. Ministers discussed it at the second Cybersecurity Related Ministers' Meeting on November 6. That morning, the cabinet had already set aside about ¥10 billion from reserve funds for what is needed immediately. We summarized the meeting and the police's new nationwide joint investigation the next day. Since then we have read the package itself, published as meeting material 2.

The package calls itself a "first step". It collects measures that can be carried out or started early, under four pillars:

  1. Thorough basic measures, including the use of AI
  2. Gathering and consolidating information, and stronger investigation and analysis
  3. A strategic response to attacks
  4. Stronger support for victims and measures to stop damage spreading

Longer-term questions are named but not answered. They are the legal framework for information collection, the government's own standards, contracts between vendors and their clients, supply chain risk in government systems, AI misuse and quantum computing. The annex accordingly also lists items with longer horizons, such as a roadmap for post-quantum cryptography and a quantum key distribution testbed.

The diagnosis#

The opening paragraph is the most useful part for anyone who has followed this year's breaches:

In recent leak cases, there were many instances where basic measures, at the organization itself or at its contractors, were not sufficient: known vulnerabilities left unaddressed, misconfigured websites and the like, and insufficient security measures when developing applications. With the advance of AI, we are in an era where such gaps are exploited in a short time and on a large scale.

Three things stand out. The government names contractors alongside the victims themselves, which matches how many of 2026's largest breaches happened, from email delivery platforms to booking and payment services. It treats AI as a factor in speed and scale, not as the cause, the same line we took in our frontier-AI analysis. And it draws a consequence many companies have avoided: since unknown vulnerabilities may also be exploited, the scale of damage has to be limited by not holding more personal data than necessary.

What happens when#

When Measure Lead
Already done Cyber Council set up (October); "Trusted Group" for two-way sharing with operators inside it; IPA and SME free consultation desks (October 16 and 27); NCO special site (October 30); NCO technical warning on web and app basics (November 5); first meeting of director-generals on strategic options against attack campaigns (end of October) NCO, METI
November 2026 Outreach team (provisional name) contacts organizations at risk, checks for suspicious activity and arranges threat hunting NCO
November 2026 Top-gun team at IPA: penetration testing with high-performance AI, training and tools for security firms METI
November 2026 Warning video for individuals Cabinet Secretariat
"Promptly" Police nationwide joint investigation and a Fast Forensic Force (provisional) for log preservation and early cause analysis NPA
By end of 2026 Threat hunting manuals and detection tools via the Cyber Council NCO
By end of 2026 Measures against domestic devices abused as stepping stones (with carriers and NICT) NCO, MIC and others
By end of 2026 Police corporate reporting window, "Cyber Damage 110" (provisional), at every prefectural headquarters NPA
Around January 2027 IPA observation network for supply chain companies, monitoring around the clock METI, MIC
January 2027 (target) PPC security measures guideline examples take effect PPC
By March 2027 Secretariat for the public-private cyber rescue team (provisional) set up in the NCO; Joint Response Team of NCO, ministries, police and SDF for serious cases; NICT analysis strengthened; sector-by-sector guidance on storing ID document images NCO, MIC, PPC
From around March 2027 SCS supply chain security rating starts; NCO can request information from rated companies that are attacked NCO, METI
From April 2027 NCO unit dedicated to incident analysis and warnings, with private-sector analysts NCO
By March 2028 Owners of systems on the Government Cloud run source code vulnerability checks with high-performance AI Digital Agency
To be studied Carrier "access suppression" measures; contract terms on who handles vulnerabilities; detecting suspicious traffic to private companies (PM's instruction) MIC, NCO

The rescue team is narrower than its name suggests. It goes to a victim only when the victim asks and the NCO finds the need and urgency "particularly" recognized. Serious cases that threaten lives, property or national security go to the Joint Response Team, which also promises to spare victims repeated interviews by different agencies.

What it asks of whom#

Municipalities get the most concrete instructions. The Ministry of Internal Affairs and Communications will ask every local government to know all its web systems, including those a section adopted on its own and those a contractor runs; to enforce multi-factor authentication and data minimization; to run AI-assisted vulnerability assessments; and to consider taking a service offline until the fixes are done. A support team with assessment firms is to cover all local governments.

Government systems must manage IT assets including a software bill of materials (SBOM) and bring AI-assisted vulnerability assessments forward.

Private companies get warnings, encouragement and support:

  • The NCO's November 5 warning on web and app basics.
  • The PPC will speed up its guideline revision, issue sector-by-sector guidance on how long and how companies keep images of ID documents, enforce the privacy law strictly in breach investigations and issue broad warnings about common problems it finds.
  • Security vendors and cloud providers registered under ISMAP are urged to join the Cyber Council.
  • Operators whose compromise would have a large social impact are encouraged to run threat hunting; police and the Self-Defense Forces can hunt or help on request.
  • Ministries will collect information from victims of serious cases, "in the same way" as the information sharing system for critical infrastructure. The text sets no deadline. The Prime Minister separately asked for critical infrastructure reports within a few hours, or at least the same day.
  • Police and ministries will request that companies report incidents and hand over logs.
  • Small businesses get more from the existing "Otasuketai" service: diagnosis after an incident, regular backups and recovery support, and regular vulnerability scans.

Sector ministries add their own items for finance, telecoms, healthcare, schools and universities, ports and food supply.

Information back to defenders#

The package's second pillar describes a loop: collect attack information from the public and private sectors at the NCO, analyse it with AI, and "return the results to society". Several measures give that loop some substance:

  • Inside the Cyber Council, the "Trusted Group" shares technical information such as attack source IP addresses, attack techniques and assessments in both directions, and runs joint analysis to produce information that is "actionable" for companies.
  • The NCO will tailor what it publishes to executives, security experts and the public. Its examples for experts include cross-case analysis of attack techniques, a list of vulnerabilities confirmed to be exploited in Japan ("Japanese KEV") and publication of attackers' infrastructure and techniques. Press releases for the public are to say "what is happening (including whether AI was misused)".
  • The government will work with overseas tech firms and frontier AI companies to obtain attack information and vulnerabilities before disclosure. Japan's AI Safety Institute will evaluate the cyberattack capabilities of high-performance AI models and share results through the Cyber Council.
  • NICT, which identified the A2B attack pattern, will build an environment to reproduce attacks by AI agents.

These are examples and plans, not dated commitments. The dedicated NCO unit that would produce the analysis starts in fiscal 2027.

Safer identity checks#

This autumn's breaches included images of driver's licenses and other ID documents, collected for online identity checks. A password can be changed; a license image cannot. The Financial Services Agency had already asked banks to stop accepting ID photo uploads before the legal deadline of April 2027. The package takes the same direction across sectors:

  • The government will expand identity checks that read the IC chip in My Number cards and similar cards, in the private sector as well as in public services, citing public anxiety about license images.
  • The Digital Agency's Digital Authentication Service, which lets companies verify identity with a My Number card, will get stronger checks against misuse: confirming the certificate is still valid at each authentication and controlling tokens at logout. Its operation is being reinforced, and private companies will get help to adopt it.
  • A new age check will give a service only the age or age range it needs, without the date of birth or other extra data.
  • The systems behind the card and its public key infrastructure will be made more secure over the medium to long term.
  • The PPC will issue guidance, sector by sector, on how long and how companies may keep ID images they have already collected.
  • Lenders and account providers will be asked to apply the identity checks required by the anti-money laundering law strictly, so that leaked data cannot be used to open accounts in someone else's name.

What is still open#

  • Companies are asked, not required. For private companies outside critical infrastructure, the package works through warnings, requests and support. It does not create new rules itself. Those would come from the PPC's guideline revision, the law amendment the Prime Minister asked the minister to study, and the SCS rating, under which a rated company can be asked for information after an attack.
  • Contracts are only studied. The package admits that development and maintenance contracts often do not say who must fix a newly found vulnerability, which caused problems when the critical PHP flaws appeared. It only promises to "proceed with consideration" of how to spread better contract terms.
  • Blocking is undecided. The text says only that carriers' "access suppression" measures to prevent misuse of leaked data will be studied "urgently, including legal issues". It does not say what would be blocked.
  • Ransomware gets less. The package is built around data breaches. Business disruption appears mainly as backup and recovery support for small businesses, healthcare drills and an exercise on large infrastructure failures.

Our view#

The diagnosis is the right one, and it is in writing. The government says plainly that most of these breaches came from basic failures, at victims and at their contractors, and that AI made them faster and bigger, not possible. That tells every company what to fix first, and it is a better starting point than either blaming sophisticated attackers or selling AI as the answer.

Pooling and using information is the core. Until now, each breach in Japan was handled as a separate case: one company, one police force, one notice that rarely said how the attackers got in. The package puts several pieces in place to change that at once: the police's nationwide joint investigation, faster reporting to the NCO, the Trusted Group, the PPC's promise to warn widely about problems common to the cases it investigates, and an NCO that publishes a Japanese KEV list, cross-case analysis and attacker infrastructure. In our view this is the part to expect most from, because only a body that sees many incidents can find the patterns, and the NCO's November 5 document showed it can turn them into specific guidance. The test is the return flow. Collection costs victims time in the middle of an incident, which the package acknowledges, and it is worth that cost only if lessons come back. The analysis unit does not start until April 2027, and we hope useful output comes well before then.

Safer identity checks deal with the damage that lasts. Leaked passwords can be reset; leaked license images stay useful to fraudsters for years. Reading the IC chip means a company no longer has to collect and store an image at all, and an age check that discloses only an age range is data minimization built into the design. The value depends on adoption: private services will move only if the Digital Authentication Service is easy to integrate and trustworthy. Hardening it now, with certificate checks and token control, is the right priority for a service that will become a shared foundation and therefore an attractive target.

The basics are the unglamorous part, and they are there. An inventory of every web system, including those run by contractors; SBOMs; data minimization; and, for municipalities, permission to switch a service off until it is fixed. Pausing a service as a security control was what the better Japanese services did when the PHP flaws came out, and it is now in government policy. The admission that contracts often do not say who fixes vulnerabilities matters too, even though the response so far is a study.

Companies' part. An emergency package is not the place for new legal duties, and the package does not try to be. Its effect on the long tail of contractors that held much of the leaked data will depend on whether clients pass requirements down, through contracts and the SCS rating, and on how the PPC applies its revised guideline.

What this means for practitioners#

  • Fix the basics the package names. Unpatched known vulnerabilities, website and cloud misconfigurations and development security, for your own systems and your contractors'. The NCO's November 5 warning is the checklist.
  • Make an inventory of internet-facing systems, including those run by contractors, and decide in advance who can take one offline.
  • Check your contracts. Who must apply an emergency patch, how fast, and who pays? The package says this is often unclear.
  • Delete what you do not need, starting with ID document images and old payment data.
  • Plan the move to IC chip identity checks if you still accept uploaded ID photos, and look at the Digital Authentication Service as one way to do it.
  • Prepare for threat hunting. If you run critical services, expect the NCO's manual and tools by the end of the year, and the outreach team may contact you.
  • Know where to report. The police corporate window, IPA and the regional free desks are open or opening; keep logs so that you can hand them over.

Japanese terms at a glance#

Japanese Reading Meaning
サイバーセキュリティ緊急対策パッケージ saibā sekyuriti kinkyū taisaku pakkēji Cybersecurity Emergency Countermeasures Package
サイバーセキュリティに関する関係閣僚会議 saibā sekyuriti ni kansuru kankei kakuryō kaigi Cybersecurity Related Ministers' Meeting
国家サイバー統括室 kokka saibā tōkatsu-shitsu National Cybersecurity Office (NCO)
基本的な対策 kihonteki na taisaku Basic measures
委託先 itaku-saki Contractor
アウトリーチ・チーム autorīchi chīmu Outreach team
官民サイバー救援隊 kanmin saibā kyūentai Public-private cyber rescue team
脅威ハンティング kyōi hantingu Threat hunting
踏み台 fumidai Stepping stone (abused relay device)
日本版 KEV nihon-ban KEV Japanese Known Exploited Vulnerabilities list
サイバー協議会 saibā kyōgikai Cyber Council
アクセス・無害化措置 akusesu mugaika sochi Access and neutralization measures
アクセス抑止策 akusesu yokushi-saku Access suppression measures
ICチップの読取 IC chippu no yomitori Reading the IC chip (in an ID card)
デジタル認証サービス dejitaru ninshō sābisu Digital Authentication Service (Digital Agency)
公的個人認証 kōteki kojin ninshō Public key infrastructure for individuals (My Number card)
サイバーセキュリティお助け隊サービス saibā sekyuriti otasuketai sābisu Otasuketai cybersecurity support service for SMEs