Topic
GMO Internet answered the extortion of its Onamae.com Desktop Cloud customers with a public campaign: a request for active cyber defense, a CEO blog, a $1 million bounty with daily tip counts and a stream of social media posts. Its customer advice was good. The spectacle around it was, in our view, the worst way to respond to people who need attention.
ThreatsUpdated
Japan's NICT says attackers are analyzing public Android apps to map and attack their backend APIs, one cause of Japan's breach wave. The four flaws targeted, and what to check.
Policy & LawUpdated
How Japan's privacy law requires companies to report data breaches: the four triggers, the 3–5 day and 30/60-day deadlines, contractors, notifying people, and the 2026 amendment.
Policy & LawUpdated
In one week, eight Japanese agencies warned companies after a wave of breaches. What each asks, and why the FSA wants banks to drop ID photo uploads before 2027.
ThreatsUpdated
Japan's national CERT describes the attacks behind the breach wave: known-flaw scanning, internal API abuse, a Metabase bug, web shells and AI penetration testing tools such as ARTEX and Cairn, with attacker IPs.
Japan's Personal Information Protection Commission warns large data holders, previews tougher guidance including phishing-resistant MFA, and flags API abuse.
Data & TrackersUpdated
Japan's police recorded a record 123 ransomware cases in H1 2026. Victims, entry points, recovery time, costs and failed backups, in English from NPA data.
IncidentsUpdated
Attackers used a VPN flaw to break into GSS, the shared government IT platform run by Japan's Digital Agency, exposing data on 246,000 officials and contractors.
Policy & LawUpdated
Japan's active cyber defense law in English: incident reporting for critical infrastructure from Oct 1, 2026, police powers against attack servers, and vendors' role.