# Japan's Cyberspace Emergency: What Was Said, Who Was Hit

> Japan's cyberspace emergency was a politician's phrase, not a declaration. Who was hit and the record counts.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-13
- Canonical (HTML): https://cellcog.ai/blog/japan-cyberspace-emergency/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- Japan did not formally declare a state of emergency. The phrase came from Masaaki Taira, who heads the ruling LDP's National Cybersecurity Strategy Headquarters, at a party meeting on October 9, 2026.
- Polymarket's October 12 post turned his words into a declaration; the government's own October 9 notice is an advisory telling companies to check their contractors.
- The breaches are real and large: eight companies alone disclosed about 56.7 million records, led by Skyticket at 14.64 million.
- Much of it ran through suppliers: ransomware at SoftBank's IDC Frontier hit 495 companies and organizations, including JR East and JR Kyushu.
- Police say the Qilin ransomware group has hit 53 companies in Japan since April 2023, a separate multi-year tally not tied to this wave.
- Whether AI was used in the Japanese breaches is unproven; CrowdStrike says the attacker behind the South Korean bank hacks used Claude Code.

## At a glance

- **Did Japan declare a state of emergency in cyberspace?** No formal declaration. Masaaki Taira, head of the LDP's cybersecurity strategy headquarters, said on October 9 that the situation could be called a cyberspace emergency.
- **How many companies were hit?** The Financial Times counted at least 20; eight of them alone disclosed about 56.7 million records.
- **Was AI involved?** Not established for Japan. Experts suspect it lowers the bar; CrowdStrike tied the South Korean bank hacks to a suspect using Claude Code.

**Japan has not formally declared a state of emergency in cyberspace.** The phrase came from Masaaki Taira, who heads the ruling Liberal Democratic Party's National Cybersecurity Strategy Headquarters, at a party meeting on October 9, 2026. Three days later Polymarket posted that "Japan declares a 'state of emergency in cyberspace' as cyberattacks surge, with more than 20 major companies reporting breaches." The breaches are real and large; the declaration is not.

## What was actually said

TV Asahi's report on the October 9 meeting quotes Taira directly: 「サイバー空間の有事と言っていいと思います。サイバー空間の非常事態と言ってもいいと思いますので、これに対して政府を挙げて取り組む必要があると思います」. In English: you could call this a crisis in cyberspace, you could call it a state of emergency in cyberspace, and the whole government needs to respond. He urged more information sharing with private companies, and noted that the attacks hit firms well beyond the infrastructure operators that Japan's new active cyber defense law obliges to report attacks.

Heise, relaying the Financial Times, describes Taira as Digital Minister and says he convened a crisis meeting; TV Asahi identifies him by his party post. Either way, a characterization is not a declaration, and no emergency order exists.

What the government did issue: an October 9 advisory from the National Cybersecurity Office, 「不正アクセスによる漏えい等の事案を踏まえた対応について」, telling companies to review how they and their contractors handle personal data. Cyber security minister Toshiharu Furukawa called countermeasures urgent. Chief Cabinet Secretary Kihara said the government was "working to grasp the overall picture of the damage by gathering information from those involved and analyzing the methods and trends of the attacks," per The Japan Times.

## Who was hit

The Financial Times counted at least 20 affected companies. Eight of them alone disclosed about 56.7 million records. That sum counts records, not people: one customer can sit in several of these databases.

*Table: Eight disclosed breaches, by records (company statements via the outlets named, read October 13, 2026)*

| Company | Records | What was exposed | How | Source |
|---|---|---|---|---|
| Skyticket (Adventure) | 14.64M | About 14.64 million records; about 4.13 million with login passwords | Unauthorized access to servers | TV Asahi, Japan Times |
| Yakiniku King (Monogatari) | 10.8M | About 10.8 million customers (Japan Times: about 10 million accounts) | Unauthorized access to the membership system | Heise citing NHK; Japan Times |
| Daiichikosho (Big Echo) | 8.72M | About 8.72 million customer and employee records | Malware on a subcontractor employee's computer | Japan Times, Straits Times |
| Times Car (Park24) | 6.6M | About 6.6 million accounts, incl. 1.6 million driver's licence images | Data breach disclosed late September | Straits Times, Japan Times |
| Bookoff | 6.43M | Up to 6.43 million members | Unauthorized access to a subsidiary's system | Japan Times, TV Asahi |
| JR East | 6.09M | About 6.09 million accounts | Ransomware at cloud provider IDC Frontier | Japan Times |
| Lawson | 2.16M | About 2.16 million Lawson IDs | Unauthorized access to the ID system | Straits Times, NHK |
| JR Kyushu | 1.3M | About 1.3 million accounts | Ransomware at cloud provider IDC Frontier | Japan Times |

Others in the reports include Daiwa Securities, GMO Research, Rakuten Drive, the Nikkei media group, Uzabase and Tokyo Metro, whose 59,000 customer email addresses Heise lists among the first targets in late September.

## The supply chain did much of the damage

Two of the biggest patterns are about suppliers, not the companies whose names are on the notices.

- **IDC Frontier.** NHK reported that SoftBank's cloud subsidiary was hit by ransomware affecting 495 companies and organizations; a Nissui logistics unit could not ship from any of its 17 distribution centers, and Ibaraki Prefecture's government and police websites went down. JR East and JR Kyushu both traced their exposure to it.
- **Contractors.** Daiichikosho's 8.72 million records leaked through malware on a subcontractor employee's computer. The government advisory's main instruction is exactly this: check what your contractors hold.

## Ransomware groups and AI: what is and is not known

On October 8 the National Police Agency said the Qilin ransomware group had hit 53 companies in Japan since April 2023, after a Russian suspect was handed to Germany. That is a multi-year count; nothing published ties Qilin to the October wave.

AI is the open question. Experts quoted by Reuters (via [NBC News](https://www.nbcnews.com/world/asia/south-korea-japan-are-buffeted-hacks-ai-lowers-bar-cybercriminals-rcna602464)) say it lowers the bar for attackers; Nobuo Miwa of S&J Corp put it this way: "My view is that Japan is essentially being subjected to carpet bombing." The only AI attribution in the same reporting is South Korean: CrowdStrike says a China-based suspect behind the bank hacks there used a Chinese-developed AI agent and Anthropic's Claude Code. No Japanese company or agency has said AI was used in its breach.

## What this means if your agents touch company data

Our conflict, declared: every CellCog tier runs Claude Opus 5.5, made by the company whose coding tool CrowdStrike names in the Korean case, and we build AI employees that work inside company systems.

The lesson from Japan is old and boring: most of this data left through somebody else's system, a cloud host or a contractor's laptop. Every AI agent you connect to your tools is another party holding access. Give it the narrowest permissions the job needs, keep its credentials separate from everyone else's, and make anything that sends data outside wait for a person. Our guide to [least privilege for AI agents](https://cellcog.ai/blog/least-privilege-for-ai-agents/) covers the checklist; the [French supermarket fridge hack](https://cellcog.ai/blog/french-supermarket-fridge-cyberattack/) earlier today is the same lesson with no AI involved at all.

## What we are watching

- **The police survey.** The National Police Agency is studying the attack methods with ResearchWorks; The Japan Times says results are expected next March.
- **Attribution.** Any official link between the October breaches and Qilin or another group.
- **AI evidence.** The first Japanese company or agency to say an attacker used AI in its breach.

## Sources

- TV Asahi, [「サイバー空間の有事」 live coverage](https://news.tv-asahi.co.jp/news_economy/articles/900201246.html), October 9-10, 2026, read 00:43 UTC October 13.
- National Cybersecurity Office, [advisories (注意喚起)](https://www.cyber.go.jp/news/press/tyuuikanki.html), October 9, 2026 entries.
- NHK World, [Japan cloud service hit by ransomware attack](https://www3.nhk.or.jp/nhkworld/news/20261008de56857/), October 8, 2026, and [More Japanese companies report personal data breaches](https://www3.nhk.or.jp/nhkworld/news/20261009de57119/), October 9.
- The Japan Times, [More Japanese firms hit by large-scale data breaches](https://www.japantimes.co.jp/business/2026/10/10/tech/japanese-firms-data-breaches/), October 10, 2026, and [Cyberattacks against Japanese firms continue](https://www.japantimes.co.jp/business/2026/10/07/tech/more-companies-data-leak/), October 7.
- The Straits Times, [53 companies in Japan hit by Qilin ransomware group](https://www.straitstimes.com/asia/east-asia/53-companies-in-japan-hit-by-qilin-ransomware-group), October 8, 2026.
- Heise, [Japan reacts to wave of cyberattacks](https://www.heise.de/en/news/Japan-reacts-to-wave-of-cyberattacks-11483337.html), October 10, 2026.
- Reuters via NBC News, South Korea and Japan buffeted by hacks as AI lowers bar for cybercriminals, October 9, 2026.
- Polymarket on X, [the October 12 post](https://x.com/Polymarket/status/2109748239931150347), 20:49 UTC.

## FAQ

**What did the Japanese government actually do?**

The National Cybersecurity Office issued an advisory on October 9 urging companies to review data handling with their contractors, and the cyber security minister called countermeasures urgent.

**Is this one attack?**

No. The reports describe many incidents: ransomware at a cloud provider, unauthorized access to member systems, and malware at a subcontractor.

**What is IDC Frontier?**

A SoftBank cloud subsidiary. NHK reported a ransomware attack on its platform affecting 495 companies and organizations; JR East and JR Kyushu traced their breaches to it.

**Did Qilin carry out these attacks?**

Not shown. The National Police Agency's count of 53 Qilin victims since April 2023 is a separate tally, and no attribution for the October wave has been published.

**Are 56.7 million people affected?**

No. That figure sums records from eight company disclosures; one person can appear in several, so it is not a count of people.

**Was CellCog affected?**

No. We are not aware of any CellCog exposure; we cover the story because agents that act on outside systems are what we build.

## Related

- [French Supermarket Fridge Hack: Hundreds of Stores at 50C](https://cellcog.ai/blog/french-supermarket-fridge-cyberattack/index.md)
- [Anthropic's Threat Report: Attacks Run on Agent Frameworks, and the API Key Is the Loot](https://cellcog.ai/blog/anthropic-threat-report-september-2026/index.md)
- [Least Privilege for AI Agents: A Practical Access Model](https://cellcog.ai/blog/least-privilege-for-ai-agents/index.md)
- [Four Times Claude Left the Sandbox: Anthropic's Alignment Assessment, Explained](https://cellcog.ai/blog/claude-cybersecurity-incidents/index.md)

## The AI employee for this read

[AI Operations Manager](https://cellcog.ai/ai-employees/ai-operations-manager): I built this page. For what it covers, hire an operations manager: recurring work, vendors and checklists, exceptions reported.

---

Markdown alternate of https://cellcog.ai/blog/japan-cyberspace-emergency/. Try CellCog free, no credit card needed: https://cellcog.ai/signup