Japan has entered what its top cyber official called a “state of emergency in cyberspace”. A ransomware attack on a major cloud provider, followed by a series of data breaches at rail, mobility and retail companies, has put the personal data of millions of people at risk and prompted an emergency government response.
The trigger: a cloud provider goes down
On October 7, ransomware hit IDC Frontier, a SoftBank subsidiary, disrupting its IDCF Cloud service. According to IBTimes UK, the outage affected 495 corporate and local-government customers. IDC Frontier said it found no evidence that data from affected virtual servers was taken, and its investigation is ongoing. It also told customers that recovery depends on whether they hold their own accessible backups.
The government convened an emergency session on October 9. Masaaki Taira, head of the National Cybersecurity Strategy Headquarters, described the situation as an emergency, and CPO Magazine reports that he pointed to the likely use of AI in a coordinated campaign. Authorities have not established AI’s role in any specific breach.
A long list of exposed companies
The cloud incident landed on top of several breaches disclosed in recent weeks. Reported potential exposures include:
- JR East: up to about 6.09 million customer accounts, including some 1.67 million email addresses on its Eki-net platform;
- Times Mobility (Park24): about 6.6 million accounts, with roughly 1.6 million documents such as driver’s licence images accessed;
- JR Kyushu: up to 1.3 million email addresses;
- Skyticket (Adventure Inc.), Big Echo (Daiichikosho) and BookOff: several million records each.
These figures describe possible exposure, not confirmed theft. Park24 said credit card data was not involved.
The policy response
Tokyo’s reaction goes beyond warnings:
- the Financial Services Agency told banks to strengthen third-party risk management and to move away from identity checks based on uploaded document images, toward IC-chip verification such as the My Number card. The rule takes effect on April 1, 2027, but institutions are urged to act sooner;
- Japan’s new Active Cyber Defense law, activated in early October, allows authorities to proactively disrupt malicious servers;
- the National Cybersecurity Office issued guidance on patching and password hygiene and warned of attackers impersonating incident-response teams.
“Japan is essentially being subjected to carpet bombing,” Nobuo Miwa, president of S&J Corp, told Reuters.
Lessons for European companies
The Japanese wave shows how quickly one provider’s incident becomes many organizations’ problem. Three lessons apply directly to Swiss and European firms:
- Own your backups. Cloud resilience does not replace independent, tested, offline copies of critical data.
- Map third-party concentration. Know which providers would take down several business processes at once.
- Reduce stored identity documents. Images of IDs are high-value loot. Verify with chip-based or federated methods and delete what you do not need.
