Japan Declares a Cybersecurity Emergency as Attacks Hit More Than 20 Major Firms
After attacks on Lawson, Times Car, JR East and others, Japan has declared an emergency in cyberspace. Security experts say AI is making smaller targets worth attacking.
Japan has declared a cybersecurity emergency after a run of attacks on its companies in recent weeks. More than 20 major firms have reported incidents, including convenience store chain Lawson and car rental operator Times Car, according to the Financial Times. Tens of millions of pieces of customer data have been lost, among them 1.67 million customer email addresses taken from the booking system of JR East, the country's largest rail operator.
How the government described it
Cybersecurity minister Toshiharu Furukawa called the situation "extremely critical" at a meeting of the National Cybersecurity Strategy Headquarters. Masaaki Taira, who heads the NCSH, called it an emergency in cyberspace.
Data from TrendAI shared with Reuters shows Japan recorded more cybersecurity incidents in the first nine months of 2026 than in all of 2025.
Where AI comes in
Nobody has formally linked this wave to AI, but people who work in security think it plays a part. Masaki Hiraoka of Blackpanda told the FT that AI lets attackers do the reconnaissance that used to take a lot of time, which means smaller services that were never worth the effort can now become targets. Nobuo Miwa of Tokyo-based S&J Corp compared the attacks to carpet bombing and suggested AI tools may be helping foreign groups get past the language barrier that once made Japanese firms harder to hit.
The regulatory knock-on
The breaches are already changing rules outside IT. Japan's Financial Services Agency has reportedly asked lenders to accept only identity documents with chips, such as passports or MyNumber cards, because so many driving licence images leaked in the Times Car attack.
What other markets should take from it
If AI lowers the cost of reconnaissance and of writing convincing messages in a local language, being a mid-sized company or working in a less widely spoken language no longer offers much cover.
The other lesson is how fast a breach in one sector in one sector turns into a fraud problem in another. Stolen licence scans became a banking KYC issue within weeks. Security teams should ask what their leaked data would let someone do elsewhere, not just what the breach costs them.
Source: PCMag — Japan Declares Cybersecurity Emergency, Experts Nod to AI