Twice in a month, Japan's National Police Agency announced takedowns of criminal infrastructure with Microsoft and Google. Japanese media called the latest one 'neutralization', but in both cases the legal step was the company's action in the United States, not the police's new power under the active cyber defense law. Here is what the police did, what the companies did, and what is left on Japanese networks.
Japan's government blames this year's breach wave on unpatched flaws, misconfigurations and weak development security, at companies and their contractors. Its emergency package sets November deadlines for new teams, promises a Japanese KEV list and attacker infrastructure disclosures, and moves online identity checks from ID photos to the chip in My Number cards. For companies, it works mostly through requests and support.
Japan's Personal Information Protection Commission received 830 breach reports caused by unauthorized access in the first half of October alone, and is bringing forward the first major update of its security measures guideline since 2016: phishing-resistant MFA, zero trust, EDR, log retention and containment. Public comments close November 27.
Japan's communications ministry asked telecom carriers to block the site where GMO's attackers published customer data. Blocking is rare in Japan because it touches the constitutional secrecy of communications. We explain the precedents, from child abuse images in 2011 to manga piracy in 2018, and what is new this time.
Japan's ruling LDP and the tech-focused Team Mirai both issued emergency cybersecurity proposals in the week of October 20, 2026. We compare them, and test them against what this year's breaches actually show.
Japan's trade minister says IPA will set up a team of 'off-white hackers' in November to attack systems harder than attackers do, using AI. It follows a ruling party proposal calling the breach wave the 'eve of a cyber emergency'. What was announced, and the questions it leaves.
Japan amended its privacy law (APPI) in July 2026: first administrative fines, rules for children's and face data, an AI and statistics exception, contractor duties, and new crimes.
How Japan's privacy law requires companies to report data breaches: the four triggers, the 3–5 day and 30/60-day deadlines, contractors, notifying people, and the 2026 amendment.
In one week, eight Japanese agencies warned companies after a wave of breaches. What each asks, and why the FSA wants banks to drop ID photo uploads before 2027.
Japan's Personal Information Protection Commission warns large data holders, previews tougher guidance including phishing-resistant MFA, and flags API abuse.
Japan's official yearly cybersecurity review, published only in Japanese, summarized in English: phishing, ransomware, active cyber defense, AI and supply chains.
Japan's government-backed ★3 and ★4 security marks for suppliers open in March 2027. How the SCS rating works, what it costs, and why it may not add security.
Japan's cabinet approved a bill on October 16, 2026 letting designated police officers remotely access devices used by criminal groups and copy data from encrypted apps, with a judge's permit. What the bill says, and the risks.
Japan's active cyber defense law in English: incident reporting for critical infrastructure from Oct 1, 2026, police powers against attack servers, and vendors' role.