Securify

Japan announced a ¥10 billion ($63 million) emergency cybersecurity package on Friday after a punishing wave of data breaches hit dozens of companies and government agencies, exposing millions of citizens’ records and shaking public confidence in the country’s digital infrastructure.

Prime Minister Sanae Takaichi unveiled the plan at a ministerial meeting, warning that “at this very moment, cases of unauthorized access and data breaches are occurring” with a major impact on daily life and corporate activity. The package represents one of the most aggressive government responses to cyber threats ever announced by a G7 nation and signals a fundamental shift in how Japan intends to defend its digital borders.

The Attacks That Forced Japan’s Hand

The emergency declaration follows a string of high-profile breaches that have swept across Japan’s corporate and public sectors in recent months. While the government has not released a comprehensive incident list, reporting from SecurityWeek and AP identifies several major victims:

Telecommunications giant KDDI suffered a breach affecting approximately 12 million customers, making it the largest known incident in the recent wave. Sony’s Japanese internet service So-net was hit with an exposure of 2.6 million records. Financial news publisher Nikkei lost 1.8 million records. The Digital Agency, Japan’s own government body responsible for digital transformation, saw data on 240,000 people compromised. Frozen-food manufacturer Nichirei reported operational disruptions from a separate intrusion.

In total, dozens of organizations across sectors—from telecom and media to food manufacturing and government—have been compromised. The sheer breadth and volume of the attacks have caused what officials describe as widespread “uneasiness across Japan.”

Inside the Emergency Package

The ¥10 billion plan is built around four pillars: information sharing between public and private sectors, rapid assistance for breach victims, recovery support, and the ambitious goal of achieving “one of the world’s highest levels of cybersecurity.”

The most consequential element is the expansion of Japan’s “active cyber defense” capability. Legalized by legislation passed in October 2026, this policy grants the government authority to proactively access servers used by attackers as a preemptive countermeasure. In practice, this means Japanese authorities can now take offensive action against threat infrastructure before or during an attack—a significant departure from Japan’s traditionally defensive posture and its pacifist constitutional framework.

When a potential challenge to national security is identified, a joint support team drawn from the Defense Ministry, the National Police Agency, and the National Cybersecurity Office will deploy to coordinate the response.

The Ministry of Economy, Trade and Industry (METI) is tasked with standing up an elite “top gun” team of cybersecurity experts by the end of November 2026. This team will use artificial intelligence to counter hackers, detect network vulnerabilities, and proactively hunt threats. METI plans to partner with technology companies and advanced AI developers in allied nations—a nod to deepening cybersecurity cooperation within frameworks like the Quad and the Five Eyes-adjacent partnerships Japan has been cultivating.

The package also establishes a “cyber rescue team” composed of public and private sector specialists who will provide initial incident response to organizations hit by cyberattacks. A separate team will focus on proactive defense, helping companies considered vulnerable to shore up their security before an attack occurs.

Why This Matters Beyond Japan

Japan’s emergency declaration matters for several reasons that extend well beyond its borders.

First, the scale of the attacks themselves is striking. A combined exposure of more than 16 million records across just the named incidents—KDDI, So-net, Nikkei, and the Digital Agency—illustrates how rapidly a nation’s digital ecosystem can unravel when multiple organizations are breached in quick succession. The breadth of affected sectors suggests either a coordinated campaign or a target-rich environment that multiple threat actors are exploiting simultaneously.

Second, Japan’s embrace of active cyber defense marks a geopolitical milestone. For decades, Japan’s approach to cybersecurity was overwhelmingly passive, constrained by both legal limitations and a cultural reluctance toward anything that could be perceived as offensive military capability. The October legislation and this week’s emergency package represent a decisive break from that tradition. Japan now joins a growing list of democracies—including the United States, the United Kingdom, Australia, and France—that have formalized the authority to conduct offensive cyber operations against adversaries.

Third, Takaichi’s explicit mention of “AI-generated attacks” as a driving concern reflects a growing global awareness that AI is reshaping the threat landscape. Attackers are using AI to craft more convincing phishing campaigns, automate vulnerability discovery, and scale intrusions in ways that were impractical even two years ago. Japan’s decision to fight AI with AI—embedding it into the “top gun” team’s methodology—may serve as a template for other nations grappling with the same challenge.

Context: Japan’s Cybersecurity Gap

Japan has long been considered an outlier among advanced economies when it comes to cybersecurity readiness. Despite being the world’s fourth-largest economy and a global technology leader, Japan has historically underinvested in cyber defense relative to peers. A 2024 assessment by Japan’s own National center of Incident readiness and Strategy for Cybersecurity (NISC) found that many critical infrastructure operators lacked basic incident response plans.

The country’s cybersecurity workforce shortage has been well-documented. Industry estimates have consistently placed the shortfall at several hundred thousand professionals—a gap that the new “top gun” initiative and expanded public-private partnerships are designed to begin addressing.

Previous major incidents, including the 2024 cyberattack on Kadokawa and its Niconico video platform, had already raised alarm bells. But the current wave’s breadth—spanning a telecom serving millions, a government digital agency, and a major financial publisher—appears to have been the tipping point for emergency action.

What to Watch Next

Several developments are worth monitoring in the weeks ahead. The “top gun” team is expected to be operational by month’s end, and its early actions—particularly any public attribution of the recent attacks—will signal how aggressively Japan intends to use its new capabilities. The active cyber defense law’s first real-world application will also be closely watched, both for its effectiveness and for how Japan navigates the legal and diplomatic implications of preemptive access to foreign servers.

For organizations operating in or connected to Japan, the immediate takeaway is practical: expect heightened scrutiny of cybersecurity practices, potential new compliance requirements, and a government that is now willing and legally authorized to take a more hands-on role in incident response. Companies with operations in Japan should review their incident response plans, ensure they have clear communication channels with Japanese authorities, and be prepared for a regulatory environment that is evolving rapidly.

As Takaichi put it: “Let us increase the response capability across Japan by devoting all government resources.” For a nation that long treated cybersecurity as a secondary concern, that is a statement with teeth.