Japan's Ruling Party Calls a Wave of Cyberattacks a "State of Emergency in Cyberspace"

A wave of cyberattacks has hit Japan over the past few weeks. Both the ruling party and the government are now treating it as a crisis. This was not a formal national emergency declaration.

On October 9, the Liberal Democratic Party's National Cybersecurity Strategy Headquarters held a meeting to hear briefings from government agencies. The body's head, former Digital Minister Masaaki Taira, said the situation "could be called a state of emergency in cyberspace" and that the whole government needs to respond, as reported by Nikkei, Yomiuri, and TV Asahi. On the same day, the Cabinet Secretariat's National Cybersecurity Office (NCO) issued an advisory to businesses that handle personal data. It called for supply-chain security and keeping stored data to a minimum (Asahi, PC Watch).

Some of the incidents behind it:

• Times Car: Park24 says an intrusion detected on September 25 leaked data from about 6.6 million accounts. About 1.6 million of those accounts also had ID document images exposed, such as driver's licenses. Both figures are correct; the second is a subset of the first (Park24, 2nd report, 3rd report).
• IDC Frontier: SoftBank's cloud subsidiary disclosed a ransomware attack on its IDCF Cloud on October 7. It says 495 contracted companies and local governments were affected, and that data in four East Japan zones may only be recoverable from customers' own backups. The 495 counts affected customers, not confirmed data leaks (IT Trend, Cybersecurity.com).
• JR East: Because of the IDC Frontier incident, up to about 1.67 million Eki-net email addresses and about 390,000 Otona no Kyujitsu Club records may have been exposed (Asahi, Nikkei).

The National Police Agency counted 123 ransomware reports in the first half of 2026, the most for any half-year since it began tracking in late 2020 (NPA report). After the Times Car leak, the Financial Services Agency asked financial institutions to move to IC-chip ID verification ahead of an April 2027 rule change (FNN). Separately, Japan's active cyber defense powers, which let police and the Self-Defense Forces neutralize attacker servers, took effect on October 1 (NHK).

The lesson for the Philippines

The IDC Frontier case is the lesson for the Philippines and the wider Asia-Pacific region. A single compromised cloud provider became an outage for hundreds of customers at once, and a rail operator's leak came through a vendor's email system, not its own network. Many organizations here rely on a few data centers, MSPs, and cloud platforms. Your provider's security is part of yours.

• Ask your providers how they isolate and recover from ransomware.
• Keep offline or immutable backups that you control.
• Map which services depend on a single vendor.
• Treat leaked ID images as a fraud risk, especially for online onboarding.