Japan on Cyberattack Alert as Ransomware Wave Hits Major Brands and Exposes Millions of Records

Japan is confronting a mounting cybersecurity crisis, with a ransomware attack disrupting hundreds of organisations and a series of separate breaches putting millions of customer records at risk. One alarming detail: experts estimate that stolen Japanese driver's licence images could be offered on dark-web markets for as little as ¥25, or around £0.12.

The incidents have prompted urgent government warnings and renewed scrutiny of how companies safeguard personal information. For consumers, the danger extends beyond stolen data to potential identity fraud, impersonation and increasingly convincing phishing attempts.

Ransomware Attack Sends Shockwaves Through Japan

The latest crisis erupted on 7 October, when IDC Frontier, a SoftBank subsidiary, suffered a ransomware attack that disrupted its IDCF Cloud service. The outage affected 495 corporate and local-government customers, with knock-on consequences for businesses relying on the platform.

Among the organisations warning of potential exposure were major railway operators. JR East said approximately 6.09 million customer accounts across its services may have been compromised, while JR Kyushu warned that up to 1.3 million customer email addresses may have been exposed.

The JR East total covers multiple services, including its Eki-net booking platform, where approximately 1.67 million email addresses were potentially affected. These figures describe the possible scope of exposure, not a confirmed number of records stolen.

In an update published on 14 October, IDC Frontier said investigators had found no evidence that data inside affected virtual servers had been taken externally. The company did confirm unauthorised queries involving registration information for 48 customers, but found no evidence that the queried information had been removed. Its investigation continued.

Driver's Licence Images Could Be Worth Just 15 Cents

The Times Car breach has brought the risks to individual consumers into sharp focus.

Times Mobility, operator of the car-sharing service and part of the Park24 group, reported unauthorised access detected on 25 September. Approximately 6.6 million accounts were affected, and around 1.6 million documents were accessed, including driver's licence images, utility bills and student identification documents.

The Financial Times reported that experts estimated driver's licence images could be offered on dark-web markets for as little as ¥25 each. That is an estimate of potential market value, not evidence that the images were sold at that price.

Park24 said credit card information was not involved and that, at the time of its initial disclosure, it had found no evidence that the information had been made publicly available or misused. Even so, identity-document images can be valuable to criminals attempting impersonation or targeted fraud.

Major Brands Caught in a Wider Breach Wave

The incidents extend well beyond car-sharing and rail travel. Lawson, Daiwa Securities and BookOff have also reported customer-data incidents.

BookOff warned that up to 6.43 million customers could be affected. Daiichikosho, operator of the Big Echo karaoke chain, reported potential exposure involving approximately 8.72 million customers through a system managed by an external contractor. Adventure Inc., which operates the Skyticket travel-booking website, reported a potential breach involving approximately 14.64 million sets of personal information.

These are separate incidents, with differing circumstances and levels of confirmed exposure. Collectively, they have intensified concerns about how organisations manage customer data and secure third-party systems.

Japan Tightens Identity-Verification Rules

On 9 October, Japan's Financial Services Agency urged financial institutions to strengthen cybersecurity, review third-party risks and prepare to replace remote identity checks based on uploaded document images with verification using IC-chip information.

The regulatory change is scheduled to take effect on 1 April 2027, but the agency urged institutions to move sooner.

Masaaki Taira, head of Japan's National Cybersecurity Strategy Headquarters, described the situation as a 'state of emergency in cyberspace'. The warning reflects mounting concern over the scale and frequency of attacks.

Is AI Raising the Stakes?

Artificial intelligence is adding to the challenge. Security experts warn that AI tools can help criminals automate parts of the hacking process and create more convincing phishing messages, potentially lowering the barrier to entry for cybercrime.

Nobuo Miwa, president of cybersecurity firm S&J Corp, told Reuters: 'My view is that Japan is essentially being subjected to carpet bombing.'

Authorities have not established that AI was responsible for each of the reported breaches. Its potential to accelerate cybercrime, however, is becoming an increasingly urgent concern.

Japan's government has warned organisations to strengthen their defences as reported cyberattack cases have already exceeded 500 in 2026, according to a study by the Yomiuri Shimbun and Trend Micro. Digital Transformation Minister Toshiharu Furukawa warned that attacks were becoming more sophisticated.

For consumers, the immediate priority is vigilance: follow official notifications, secure affected accounts, and avoid clicking unexpected links or sharing passwords and verification codes.

With sensitive identity documents and millions of customer accounts potentially caught up in the wave, Japan's response will test not only its cybersecurity systems, but also public confidence in the companies entrusted with personal data.