Cybersecurity In Japan

Cybersecurity in Japan

Japan is one of the most connected countries in the world, but for years its approach to cyber defense was cautious. This autumn changed that. A new law came into force, a wave of breaches hit household names, and the government called an emergency meeting. I wanted to understand how it got here and how it compares with India, so this post pulls together what I found.

The jump in October stands out. Chief Cabinet Secretary Minoru Kihara said 22 leak reports that month each affected a million people or more, and the government is preparing an emergency countermeasures package (Nippon.com). The 260 million figure is a cumulative total, so some people are likely counted more than once.

Two cases from 2025 show how much one attack can cost. At Asahi, ransomware stopped shipping across the country and caused beer shortages (The Record). At Askul, attackers used a partner’s admin login that had no multi-factor authentication, and the outage also stopped Muji’s online store (BleepingComputer).

Current trends

• AI-assisted attacks. AI tools help attackers scan networks, find weak targets and get past the Japanese language barrier that once protected companies from phishing. Experts quoted by Insurance Journal link a China-developed tool called ARTEX to many recent attacks.

• Attacks through suppliers. Askul fell through a partner account, Daiwa Securities through a vendor, and JR East through a cloud provider (CS2). One breach can now spread to hundreds of organisations.

• Mass data theft. Attackers are going after public websites that hold personal data and taking whatever they can. Most victims are small, cash-rich firms with weak IT security (Insurance Journal).

• Familiar ransomware groups. Qilin and LockBit were the most common strains in 2025 (Nippon.com).

• A skills gap. Keio University’s Motohiro Tsuchiya put it bluntly: “We are much, much weaker than other G7 countries” (Insurance Journal).

Japan’s response

Until recently, Japan’s defense was mostly passive. The Active Cyber Defense law, passed in May 2025, came into force on 1 October 2026. It lets police and the Self-Defense Forces access and disable servers used in serious attacks, including ones abroad, under an independent oversight committee (Vision Times). The government can collect communication data such as IP addresses, but not the content of private messages.

On 9 October, after a week of attacks, the National Cybersecurity Strategy Headquarters held an emergency session and issued mandatory security instructions to all ministries (Tech Times). This builds on a five-year strategy from December 2025 that names China, Russia and North Korea as serious threats (Nippon.com).

The biggest contrast is in approach. India leans on fast reporting: its six-hour rule to CERT-In is one of the strictest in the world. Japan is now going further and taking action against attackers directly. On data protection, India is still catching up, since the DPDP breach-reporting rule only applies from mid-2027.

The similarities matter just as much. Both countries see attackers going after smaller, less protected organisations, and both are short of skilled people. What is happening in Japan right now could easily happen in India next.

What I took away

I expected a story about advanced hackers. Instead, the biggest problems were familiar ones: weak logins, trusted vendors and backups that weren’t really separate. AI is making those old weaknesses easier to find at scale. For me, the clearest lesson is that your security is only as strong as the weakest company you depend on.