Japan has not formally declared a state of emergency in cyberspace. The phrase came from Masaaki Taira, who heads the ruling Liberal Democratic Party’s National Cybersecurity Strategy Headquarters, at a party meeting on October 9, 2026. Three days later Polymarket posted that “Japan declares a ‘state of emergency in cyberspace’ as cyberattacks surge, with more than 20 major companies reporting breaches.” The breaches are real and large; the declaration is not.
On this page · 7 sectionsOpen
Japan did not formally declare a state of emergency. The phrase came from Masaaki Taira, who heads the ruling LDP’s National Cybersecurity Strategy Headquarters, at a party meeting on October 9, 2026.
Polymarket’s October 12 post turned his words into a declaration; the government’s own October 9 notice is an advisory telling companies to check their contractors.
The breaches are real and large: eight companies alone disclosed about 56.7 million records, led by Skyticket at 14.64 million.
Much of it ran through suppliers: ransomware at SoftBank’s IDC Frontier hit 495 companies and organizations, including JR East and JR Kyushu.
Police say the Qilin ransomware group has hit 53 companies in Japan since April 2023, a separate multi-year tally not tied to this wave.
Whether AI was used in the Japanese breaches is unproven; CrowdStrike says the attacker behind the South Korean bank hacks used Claude Code.
§ 01What was actually said
TV Asahi’s report on the October 9 meeting quotes Taira directly: 「サイバー空間の有事と言っていいと思います。サイバー空間の非常事態と言ってもいいと思いますので、これに対して政府を挙げて取り組む必要があると思います」. In English: you could call this a crisis in cyberspace, you could call it a state of emergency in cyberspace, and the whole government needs to respond. He urged more information sharing with private companies, and noted that the attacks hit firms well beyond the infrastructure operators that Japan’s new active cyber defense law obliges to report attacks.
Heise, relaying the Financial Times, describes Taira as Digital Minister and says he convened a crisis meeting; TV Asahi identifies him by his party post. Either way, a characterization is not a declaration, and no emergency order exists.
What the government did issue: an October 9 advisory from the National Cybersecurity Office, 「不正アクセスによる漏えい等の事案を踏まえた対応について」, telling companies to review how they and their contractors handle personal data. Cyber security minister Toshiharu Furukawa called countermeasures urgent. Chief Cabinet Secretary Kihara said the government was “working to grasp the overall picture of the damage by gathering information from those involved and analyzing the methods and trends of the attacks,” per The Japan Times.
§ 02Who was hit
The Financial Times counted at least 20 affected companies. Eight of them alone disclosed about 56.7 million records. That sum counts records, not people: one customer can sit in several of these databases.
| Company | Records | What was exposed | How | Source |
|---|---|---|---|---|
| Skyticket (Adventure) | 14.64M | About 14.64 million records; about 4.13 million with login passwords | Unauthorized access to servers | TV Asahi, Japan Times |
| Yakiniku King (Monogatari) | 10.8M | About 10.8 million customers (Japan Times: about 10 million accounts) | Unauthorized access to the membership system | Heise citing NHK; Japan Times |
| Daiichikosho (Big Echo) | 8.72M | About 8.72 million customer and employee records | Malware on a subcontractor employee’s computer | Japan Times, Straits Times |
| Times Car (Park24) | 6.6M | About 6.6 million accounts, incl. 1.6 million driver’s licence images | Data breach disclosed late September | Straits Times, Japan Times |
| Bookoff | 6.43M | Up to 6.43 million members | Unauthorized access to a subsidiary’s system | Japan Times, TV Asahi |
| JR East | 6.09M | About 6.09 million accounts | Ransomware at cloud provider IDC Frontier | Japan Times |
| Lawson | 2.16M | About 2.16 million Lawson IDs | Unauthorized access to the ID system | Straits Times, NHK |
| JR Kyushu | 1.3M | About 1.3 million accounts | Ransomware at cloud provider IDC Frontier | Japan Times |
Others in the reports include Daiwa Securities, GMO Research, Rakuten Drive, the Nikkei media group, Uzabase and Tokyo Metro, whose 59,000 customer email addresses Heise lists among the first targets in late September.
§ 03The supply chain did much of the damage
Two of the biggest patterns are about suppliers, not the companies whose names are on the notices.
- IDC Frontier. NHK reported that SoftBank’s cloud subsidiary was hit by ransomware affecting 495 companies and organizations; a Nissui logistics unit could not ship from any of its 17 distribution centers, and Ibaraki Prefecture’s government and police websites went down. JR East and JR Kyushu both traced their exposure to it.
- Contractors. Daiichikosho’s 8.72 million records leaked through malware on a subcontractor employee’s computer. The government advisory’s main instruction is exactly this: check what your contractors hold.
§ 04Ransomware groups and AI: what is and is not known
On October 8 the National Police Agency said the Qilin ransomware group had hit 53 companies in Japan since April 2023, after a Russian suspect was handed to Germany. That is a multi-year count; nothing published ties Qilin to the October wave.
AI is the open question. Experts quoted by Reuters (via NBC News) say it lowers the bar for attackers; Nobuo Miwa of S&J Corp put it this way: “My view is that Japan is essentially being subjected to carpet bombing.” The only AI attribution in the same reporting is South Korean: CrowdStrike says a China-based suspect behind the bank hacks there used a Chinese-developed AI agent and Anthropic’s Claude Code. No Japanese company or agency has said AI was used in its breach.
§ 05What this means if your agents touch company data
Our conflict, declared: every CellCog tier runs Claude Opus 5.5, made by the company whose coding tool CrowdStrike names in the Korean case, and we build AI employees that work inside company systems.
The lesson from Japan is old and boring: most of this data left through somebody else’s system, a cloud host or a contractor’s laptop. Every AI agent you connect to your tools is another party holding access. Give it the narrowest permissions the job needs, keep its credentials separate from everyone else’s, and make anything that sends data outside wait for a person. Our guide to least privilege for AI agents covers the checklist; the French supermarket fridge hack earlier today is the same lesson with no AI involved at all.
§ 06What we are watching
- The police survey. The National Police Agency is studying the attack methods with ResearchWorks; The Japan Times says results are expected next March.
- Attribution. Any official link between the October breaches and Qilin or another group.
- AI evidence. The first Japanese company or agency to say an attacker used AI in its breach.
§ 07Sources
- TV Asahi, 「サイバー空間の有事」 live coverage, October 9-10, 2026, read 00:43 UTC October 13.
- National Cybersecurity Office, advisories (注意喚起), October 9, 2026 entries.
- NHK World, Japan cloud service hit by ransomware attack, October 8, 2026, and More Japanese companies report personal data breaches, October 9.
- The Japan Times, More Japanese firms hit by large-scale data breaches, October 10, 2026, and Cyberattacks against Japanese firms continue, October 7.
- The Straits Times, 53 companies in Japan hit by Qilin ransomware group, October 8, 2026.
- Heise, Japan reacts to wave of cyberattacks, October 10, 2026.
- Reuters via NBC News, South Korea and Japan buffeted by hacks as AI lowers bar for cybercriminals, October 9, 2026.
- Polymarket on X, the October 12 post, 20:49 UTC.
Q1What did the Japanese government actually do?
The National Cybersecurity Office issued an advisory on October 9 urging companies to review data handling with their contractors, and the cyber security minister called countermeasures urgent.
Q2Is this one attack?
No. The reports describe many incidents: ransomware at a cloud provider, unauthorized access to member systems, and malware at a subcontractor.
Q3What is IDC Frontier?
A SoftBank cloud subsidiary. NHK reported a ransomware attack on its platform affecting 495 companies and organizations; JR East and JR Kyushu traced their breaches to it.
Q4Did Qilin carry out these attacks?
Not shown. The National Police Agency’s count of 53 Qilin victims since April 2023 is a separate tally, and no attribution for the October wave has been published.
Q5Are 56.7 million people affected?
No. That figure sums records from eight company disclosures; one person can appear in several, so it is not a count of people.
Q6Was CellCog affected?
No. We are not aware of any CellCog exposure; we cover the story because agents that act on outside systems are what we build.