Japan Tells Ministries and Companies to Brace as Cyberattacks Pass 500 Cases This Year

Japan’s government spent Thursday in a meeting and Friday issuing instructions. The attacks had already landed. On October 9 the National Cybersecurity Office, set up last year, sent a warning to ministries to pass on to local governments and private companies: attacks are rising, they are more sophisticated, and basic controls are not optional. Digital transformation minister Toshiharu Furukawa had sat in an interministerial meeting the day before. The instructions cover updated protection, stronger passwords, and tighter checks along supply chains. They also warn that attackers have posed as people offering cyber defense, and that artificial intelligence is making flaws harder to sort. A Yomiuri–Trend Micro count released this week put incidents already above 500 this year. That is the policy sentence. The week underneath it is a cloud region encrypted on a Wednesday, a convenience-store login leak, a brokerage leak, a secondhand retailer leak, and a car-share breach measured in millions of accounts. The Cloud Hit IDC Frontier, a SoftBank national-cloud arm, said its IDCF Cloud service in East Japan Region 1 was attacked on October 7. Almost 500 corporate and municipal customers were affected. Virtual servers in four availability zones stopped and could not be restarted. The customer console stayed down, so restores were being done by hand, one client request at a time. Fibergate said its Wi-Fi authentication was hit. Medialink said its cloud phone and private-branch systems went offline. A message left on the console, reported via a screenshot carried by security outlets, claimed the intrusion took seven minutes, reached on the order of 240 hypervisors, destroyed more than 554,000 snapshots, removed about 41.5 petabytes of backup capacity, and encrypted 225 datastores. Those are the attacker’s numbers, not a government audit. What the company has confirmed is narrower and bad enough: servers down, data in four zones unlikely to be recoverable, customers waiting on manual rebuilds. JR East, its card unit View Card, and JR Kyushu said email addresses and related data for up to about 7.39 million records may have been viewed or taken. A rail group’s loyalty file sitting on a reseller cloud is the supply-chain line in the Friday warning, written after the fact. The Retail and Finance Leaks Lawson said on Thursday that personal information, including email addresses and phone numbers, had leaked from its Lawson ID system, affecting about 2.16 million IDs. Bookoff said attackers took names, birth dates, addresses, and password hashes for up to 6.43 million member numbers from a subsidiary. Daiwa Securities and the operator of the Yakiniku King barbecue chain were already on the list of unauthorized-access cases. Last month, Times Car, a car-sharing service, said information from about 6.6 million member accounts had leaked, including images of about 1.6 million driver’s licenses. None of these is a power grid. Together they are the consumer surface the office is now telling companies to lock: identity files, license photos, password hashes, email lists that can be reused. The office’s note that attackers have pretended to be defenders is the practical warning for staff who approve a “security audit” email. The note that AI is complicating vulnerabilities is the government’s way of saying the old checklist is not keeping up with the scanning. What Tokyo Can Already Do This warning sits on a law that only just switched on. On October 1, statutes passed in May last year took effect, allowing police and the Self-Defense Forces to access hostile servers to neutralize an attack before it lands, aimed at critical infrastructure. Operators of power plants, railways, and other key systems must report breaches. A public-private body is supposed to share threat information. Prime Minister Sanae Takaichi said the neutralization tools let the state respond in practice. Final permission for a preemptive step sits with an oversight commission led by former judge Hiroko Kondo, meant to check the use of communications data and remote access. A vigilance memo is not a neutralization order. The Friday instructions are passwords, patches, and supply chains. The new law is the harder tool, and it has not been publicly tied to the IDCF case. Using it on a server outside Japan, or on a cloud region run by a domestic subsidiary of SoftBank, is a different legal question from sending a circular to ministries. The 500-case count is mostly theft and ransomware against companies, which the police were already counting. The National Police Agency said Thursday that 53 companies in Japan have been hit by the ransomware group known as Qilin, the name attached to the 2025 attack on Asahi Group. Investigators recently handed a detained Russian national, suspected of being a key member, to Germany. Qilin is one actor in a year that now also includes a cloud encryption the company is still restoring by hand. What to Watch Whether IDCF confirms how much of the four zones can be rebuilt, and how many of the 495 customers are back. JR East and JR Kyushu’s final count against the 7.39 million figure. Any use of the October 1 neutralization power, which would be the first public test of the new law. Lawson, Bookoff, Daiwa, and Times Car notifications to the people whose files left. Whether the 500-case pace slows after the Friday instructions, or just gets reported faster. Japan did not discover cyberattacks on October 9. It told ministries, towns, and companies to treat a week of leaks and a downed cloud region as the baseline. The rail emails, the convenience-store IDs, and the license photos are already out. The new law can reach a hostile server. It cannot put those files back.