Japan declared a cyber emergency. The rule that matters is about ID photos.
Officials used the word emergency. The concrete response so far is a rule telling banks to stop trusting uploaded ID photos.
Japan’s government used words it doesn’t use lightly at a crisis meeting on Friday, October 9. Masaaki Taira, who leads the National Cybersecurity Strategy Headquarters, called the situation “an emergency in cyberspace.” Cybersecurity minister Toshiharu Furukawa called it “extremely critical.” Both quotes appear in every report I read, so I’m treating them as solid.
How many companies, and how much data
The Financial Times reported that more than 20 major firms have disclosed attacks in recent weeks. Not all of the numbers below measure the same thing, so I’ve kept them in separate columns and haven’t added them up.
| Organisation | What leaked | Size, per the source |
|---|---|---|
| Yakiniku King | Membership system data | 10.8 million members (NHK list, via Heise) |
| JR East | Booking-system email addresses | 1.67 million (FT, via PCMag) |
| Times Car | Account data and ID verification images | Up to 6.6 million accounts, about 1.6 million images (company, via vpnlab.io) |
| Japan Atomic Energy Agency | IDs, passports and medical check results | 175 people, through a contractor’s cloud platform (Heise) |
| Tokyo Metro | Email addresses | 59,000 (Heise) |
The trend is worse than any single row. Yomiuri and Trend Micro counted more than 500 incidents in Japan so far this year, against 473 in all of 2025 and 503 in 2024, so 2026 is on course for a record. Reuters-cited data says the first nine months of this year already exceeded the whole of last year, with 86 incidents in September alone.
Who blames AI, and who doesn’t
The headline version of this story is “AI is behind Japan’s hacks.” The sources don’t support that yet. In the FT reporting relayed by PCMag, Masaki Hiraoka of the security firm Blackpanda said the attacks had not been explicitly linked to AI. His point was that AI lets hackers skip the slow research they used to need, so smaller services that weren’t worth the effort suddenly are. Nobuo Miwa of S&J Corp called the wave “carpet bombing,” and said AI may help foreign hackers get past the language barrier that once slowed attacks on Japanese firms.
India Today writes that officials and experts say AI is helping hackers scale phishing and vulnerability scans. That fits the pattern, but the sources give no investigation that ties these particular breaches to AI. Heise also says the people behind the wave are still unknown.
My read: the AI argument is plausible, because cheaper phishing and scanning help everyone who attacks. But a reader should not come away thinking an investigator has proved it.
The rule that changes something
The most concrete step so far comes from the Financial Services Agency. According to vpnlab.io, on the same day as the meeting the FSA asked banks and crypto exchanges to check new customers by reading the chip in their ID card, not by accepting an uploaded photo of it. PCMag, citing FT reporting, says lenders should accept only ID with a chip, such as a passport or the MyNumber card. Both describe the same move. I couldn’t open the FSA notice itself, so the detail rests on those two reports.
It matters because many Japanese banks let people open an account by uploading a photo of an ID and a selfie. The trigger was the Times Car breach, which exposed licence images with face photos. Once those images are in criminal hands, a photo check proves much less than it did. The chip check compares data stored on the card with a live image of the person, and that is harder to fake.
Where the sources disagree
Two officials are described differently across the reports. Heise calls Taira Japan’s digital minister. PCMag and vpnlab describe him as the head of the strategy headquarters. India Today names the minister “Toshihiro Furukawa, Digital Transformation Minister,” while PCMag and vpnlab call him Toshiharu Furukawa, the cybersecurity minister. I’ve used the titles PCMag gives. Check the government’s own release before you quote a title.
The FT original is paywalled, so the “more than 20 firms” figure is the FT’s as reported by PCMag and Yahoo. The vpnlab.io piece comes from a VPN company’s blog. I used it only for the FSA detail, and I’d treat it as a lead to check, not a primary source.
Where I come down
The emergency language is mostly for the public. The breach counts are big, but they are company-reported and mixed across different kinds of data. The ID rule is the part to watch. If banks move to chip checks, a leaked licence photo loses much of its value. If they don’t, each leaked image stays a usable tool for impersonation.
What to watch next: whether JPCERT/CC follows its warning with named victims or a suspect, whether the FSA sets a deadline for banks, and whether other regulators copy the chip-check rule.
If you want the same question about who has to report AI-linked hacks, our piece on OpenAI and Anthropic’s disclosure fight in Australia covers the other side of that.
Sources
- Heise Online, “Japan reacts to wave of cyberattacks,” 10 October 2026: heise.de
- PCMag, relaying Financial Times reporting, “Japan Declares Cybersecurity Emergency, Experts Nod to AI” (Yahoo reprint, 10 October 2026): yahoo.com
- India Today, “Japan declares cyber emergency after hackers expose data of millions of citizens,” 11 October 2026: indiatoday.in
- vpnlab.io, “Japan cyber emergency: banks told to drop ID photo checks,” 11 October 2026 (a VPN vendor’s blog, citing the FT and the FSA): vpnlab.io
I could not read the primary pages: the National Cybersecurity Strategy Headquarters, the FSA notice, the JPCERT/CC warning, or the Reuters story (blocked by a 401). The FSA and JPCERT points above come from the reports that quote them.