Japan Tells Firms to Harden Systems After Wave of Data Leaks

Japan’s National Cybersecurity Office published an advisory on 9 October 2026 telling companies that hold large amounts of personal data to tighten their defences. The office, part of the Cabinet Secretariat, says it has confirmed multiple cases in which attackers broke into such companies’ systems and stole data that included personal information.

The four-page notice is labelled 注意喚起, an advisory or call for caution. It lists 51 measures across web systems, the supply chain and data management, by our count, and it asks executives to treat cybersecurity as a management issue, with the investment and staff that requires.

What the Advisory Says

The notice names three routes into the companies it describes: the exploitation of vulnerabilities in web systems, compromise through the supply chain, and data management that lacked robustness. It does not name any company or give a count of incidents.

It asks businesses that handle large amounts of personal information, or sensitive information, to read its main points and promptly consider making their measures more thorough. Because multiple intrusions have been confirmed, it also recommends checking access logs for traces of suspicious traffic or mass access.

Its closing paragraph is the only place AI appears. In our translation, it says that as cyberattack methods, including the misuse of AI, become more advanced and sophisticated, executives should position cybersecurity as a management issue. The notice does not say that AI was used in the incidents it describes.

The 51 Measures

On web systems, the office says internet-facing systems should be run on the premise that they could be attacked at any time. The measures include applying patches promptly, retiring products past the end of support, turning on multi-factor authentication and removing accounts of people who have left.

On the supply chain, it warns that attackers may enter through a contractor with weaker defences and then move on to the target company. It asks firms to check contractors’ security, write breach-reporting duties into contracts, share only the data a contractor needs and make sure it is deleted when the work ends.

On data, it asks firms to inventory what they hold, delete information whose purpose has ended, limit and split access rights, encrypt stored data and traffic, and never keep passwords or credentials in plain text. Data management carries the most measures, 20 of the 51.

It also asks organisations that have been hit to share technical details of the attack quickly with the office, the ministry in charge of their sector and specialist bodies.

The Meeting Behind It

ITmedia reported that the government held its first interministerial meeting on the breaches on 8 October, with executives from 29 organisations, including every ministry, discussing the advisory before it was issued.

According to ITmedia, the minister in charge of cyber security told the meeting the situation had become very critical; the Japanese word reported was 危急. ITmedia and TBS give different names for the minister, so we do not name the minister here.

At a briefing for reporters, an NCO counsellor said the office could not say for certain, but believed the breaches had increased since August, ITmedia reported. The office plans to have ministries pass incident reports to it so that it can gather information across sectors.

Advisory, Not a Declaration

Some English-language coverage framed the step as an emergency. A Financial Times headline on 9 October read: Japan declares cyber space emergency as attacks soar. The document we read is an advisory.

We checked the Japanese text of the 9 October notice for the words for emergency, state of emergency and critical. None of them appears in it. The strongest language we found came from the minister’s remark at the meeting, as reported, not from the notice itself.

The Structural Read

As we read the notice, its three routes in (web flaws, contractors and weak data handling) map onto three places a company has to defend, and only one of them is its own perimeter.

The supply-chain section describes attackers entering through a contractor with weaker defences and then moving to the target. The answer it gives is contractual as much as technical: security terms, breach-reporting duties and data deletion written into the contract.

The data section is the largest, with 20 measures by our count. Its logic, in our reading, is that data a company no longer holds cannot be stolen, and data that is encrypted is harder to misuse once taken.

Three Implications

COMPANIES HOLDING PERSONAL DATA The advisory asks for prompt action across patching, authentication, contractors and data, and for a check of access logs for signs of intrusion.

CONTRACTORS AND SERVICE PROVIDERS Clients are asked to check contractors’ security, add breach-reporting terms and require data deletion when the work ends.

BOARDS AND EXECUTIVES The notice asks executives to treat cybersecurity as a management issue, with the investment and staffing that implies.

The Business Engineer Lens

This story maps onto the Business Engineer framework Enterprise AI: From Software to Substrate.

The framework puts it this way: “For enterprises, switching costs don’t come from learning curves or data migration headaches. They come from the fact that 47 other systems now assume your existence. You’ve embedded into their workflow graph.”

As we read it, the advisory describes the security side of the same graph: an attacker who reaches one contractor can follow those connections to the company that trusted it, which is why 16 of the 51 measures concern the supply chain.

What Is Not Established

The notice does not say how many companies were breached, how many people’s data was taken, or who the attackers were. We read only the first page of the ITmedia interview with the office; the second page, which requires registration, was not read.

Nothing in the notice ties these breaches to AI tools. Its one reference to AI is a general statement about how attack methods are changing.

For context on how attacks on AI systems are being measured, we covered Microsoft’s finding that link injection is 52% of attacks on AI workloads, and Anthropic’s decision to open Mythos 5.1 to defenders in three cyber tiers.

The Bottom Line

Japan’s cyber office answered a run of data breaches with a four-page advisory: 51 measures, aimed at companies holding large volumes of personal data, with more of them on the supply chain (16) and data (20) than on web systems (15). It is a request to companies, not an emergency declaration, and it asks boards to fund the work.