Topic
Japan's national CERT has published checklists for organizations that commission an incident investigation and for the investigators who write the report, with a 42-page sample. They ask for what this year's breach notices rarely give: a clear line between what was confirmed, what is possible and what cannot be determined, and a cause specific enough to act on.
IncidentsUpdated
Sagawa Express puts its breach at 53 million records; Japan pauses websites over php2shell; AI attack tools are confirmed on both sides; email delivery services are hit three times in a month; and GMO is extorted over an FX trading VPS breach.
Qilin became a household name in Japan after the Asahi attack. In 2026, a group that grew out of Qilin's own affiliates, The Gentlemen, has listed more Japanese organizations than any other. What the data shows, and why the name matters less than the way in.
Qilin claims Keio; SourceNext, Burger King Japan and Yamato disclose millions of records; a disaster alert service for hundreds of municipalities is breached; JPCERT/CC confirms AI use; and the cabinet approves a police phone hacking bill.
Data & TrackersUpdated
Ransomware attacks on Japanese companies, hospitals, universities and local governments in 2026, as confirmed by the victims themselves, with what each one disrupted or leaked.
A record week of data breach disclosures in Japan: skyticket, Yakiniku King, Bookoff, Lawson and the IDCF Cloud ransomware attack, plus warnings from eight government agencies.
IncidentsUpdated
A ransomware attack on IDC Frontier's IDCF Cloud from October 7, 2026 hit 495 companies and local governments. Its final report says attackers broke into the customer portal's login system through an open-source flaw, took admin rights over the virtualization platform and encrypted virtual servers. It found no customer data taken; backups survive for 206 customers.
ThreatsUpdated
Japan's police and Germany's NRW confirm a 28-year-old Russian believed to lead Qilin was detained in Japan in May and handed to Germany on October 2.
IncidentsUpdated
Ransomware hit Osaka Metropolitan University's virtualization platform, stopping 500 servers and most backups. The attackers used a legitimate account of a subcontractor of NEC, which runs the university's systems.
Japan's official yearly cybersecurity review, published only in Japanese, summarized in English: phishing, ransomware, active cyber defense, AI and supply chains.
IncidentsUpdated
The Japan Times confirms a ransomware attack, first detected on September 18, 2026, and says data claimed by the attackers was published on October 15. It came from an administrative file server used until 2022, with HR and business partner data from 2001.
Data & TrackersUpdated
Japan's police recorded a record 123 ransomware cases in H1 2026. Victims, entry points, recovery time, costs and failed backups, in English from NPA data.
IncidentsUpdated
Keio, the Tokyo rail and retail group hit by ransomware on September 26, 2026, says a group claiming the attack has published part of its data. Qilin listed Keio on its leak site on October 16. What Keio has confirmed so far.