On 10 November, Internal Affairs and Communications Minister Hisayuki Fujii announced an expert panel to study the legal issues around “blocking”: having internet providers cut off access to specific websites. According to Asahi, the concern is personal data that attackers steal and then publish online. The panel will also discuss asking site operators to delete content and suspending domains. Fujii’s explanation was: “Cyberattacks are causing widespread harm to the public. We will consider what can be done to defend against them.”

ANN reports, in Japanese, on the ministry’s plan to study ways to curb access to sites that publish leaked data, with a working group starting later this month. Video: 情報漏洩サイトへのアクセス抑止策を検討　総務省　今月下旬から作業部会で議論開始(2026年11月10日) from ANNnewsCH.

He is right about the harm, and right to want to act. From 1 June to 10 November 2026, my Japan cyberattack tracker logged 1,435 publicly reported incidents affecting organizations in Japan, covering 610,627,630 records. My latest tracker update sets out what those notices show. Behind those numbers are people whose names, addresses and card details are now in criminal hands, with little they can do about it. When something on that scale happens, the instinct to make the leaked data disappear is completely understandable.

The difficulty is that blocking, deletion requests and domain suspension all act after the data has been stolen, and the technology they rely on doesn’t reach where stolen data actually goes. The same energy, aimed at the systems the data is stolen from, would protect far more people.

How blocking works, and why it leaks

When you type a website name, your device asks a DNS server where to go. DNS (the Domain Name System) is the internet’s phone book, turning a name like example.com into a numeric address. Most people use whatever DNS server their internet provider (ISP) gives them. “DNS blocking” means the ISP’s server declines to give the real answer for names on a list. When Japanese ISPs began blocking in 2011, IIJ, one of the largest, wrote that most had chosen this method because it was cheap.

It is also easy to get around. Point a phone or laptop at a different DNS server, such as one of the free public ones, and the ISP’s list no longer applies. JPNIC, the non-profit that manages Japan’s internet address space, explained this to the government in 2018. Browsers now do it for many people automatically: in February 2020, Firefox began switching its US users by default to DNS over HTTPS (DoH), which sends DNS lookups encrypted, inside ordinary web traffic, to a server the browser chooses. A VPN (virtual private network, an encrypted tunnel to a server somewhere else) hides all of a user’s traffic from the ISP.

JPNIC also described where trying to close those gaps leads. Because DoH looks like normal web traffic, ISPs end up blocking whole server addresses, which cuts off innocent sites, and eventually forcing every user’s traffic through the ISP’s own relay systems. That would cost everyone a great deal while stopping only the people who weren’t determined to look.

An English explainer on how DNS lookups work, which is the step ISP blocking interferes with. Video: How DNS Works - Computerphile from Computerphile.

Where stolen data actually goes

Ransomware groups are criminal gangs that break in, copy data, often lock systems, and demand payment. Victims who don’t pay see their data published on a leak site. Stolen data usually ends up on leak sites hosted on the dark web. These sites sit outside the normal web address system (DNS), so there is no registry to send a suspension order to.

Leak sites aren’t the only outlet. Palo Alto Networks’ Unit 42 researchers documented the Medusa ransomware group releasing victims’ files through a public Telegram channel, which they noted was more accessible than a dark web leak site.

Even a full takedown buys little time. In February 2024, Operation Cronos, run by police from 11 countries with Europol, seized the servers and leak site of LockBit, then one of the most active ransomware groups. Within days it was back at a new dark web address.

The UK National Crime Agency announces the Operation Cronos disruption of LockBit, in English. Video: The NCA announces the disruption of LockBit from the National Crime Agency.

Once data is out, it also spreads beyond any single site. After KADOKAWA was hit by an attack found on 8 June 2024, claimed by a group calling itself BlackSuit, the company said that by 10 July it had identified 473 malicious posts spreading leaked information on X, 5channel, summary (matome) sites, Discord and elsewhere. Blocking the original leak site would not have reached any of them.

Article 21 of the Constitution says that “the secrecy of any means of communication” shall not be violated, and Article 4 of the Telecommunications Business Act applies it to communications handled by telecom carriers. The ministry’s own guidance says this covers who is communicating, when and from where, as well as content. To block a site, an ISP has to check where every customer is trying to go, which is why Asahi notes that blocking assumes monitoring all users’ traffic.

Japan’s ISPs already block a narrow category of the most serious illegal content, and they have done so since 2011 without a dedicated law. They rely on the Penal Code’s emergency necessity exception, which applies only when no other way exists. In 2018 the government tried to extend blocking to manga piracy. The task force on legislating it couldn’t agree. Nine of its 18 members (50.0%) asked for it to be shelved over constitutional concerns, and no law followed.

Those were serious people working hard on a real problem, and they couldn’t make blocking fit. Leaked personal data would face the same tests, including the requirement that no less intrusive option exists.

What can be achieved instead

Chasing leaked data across the dark web, Telegram and hundreds of reposts is a goal no ministry can reach. Keeping the data from being stolen in the first place is hard, slow work, but it is achievable, and the evidence points to four places to put the effort.

Updating toolsets, permissions, and protocols. Start with the toolset: old software keeps running long after its makers stop fixing it.

In October I looked at the homepages of 1,732 Tokyo Stock Exchange-listed companies. Of the 167 that show their exact PHP version, 99 (59.3%) run a version PHP no longer patches: 36 (21.6%) on PHP 7.4 and 30 (18.0%) still on PHP 5. The 7.4 sites can now, in theory, be fixed by recompiling PHP from source. The PHP 5 sites have no fix from PHP at all. Whether the site is WordPress, an online shop or a single contact form makes no difference, because the reported flaw is in PHP itself. Some Linux vendors, Red Hat among them, fix old PHP versions without changing the number, so some of those 99 are covered. Most probably are not, and I’m not naming any of them while attacks are under way.

Permissions decide who and what can reach personal data. Each staff account, vendor login and automated system should be able to reach only the data its job needs, so one stolen password opens a drawer instead of the whole filing cabinet. Protocols are the agreed steps for applying updates, granting and removing access, and handing data to and back from a vendor. Written down, with a named person responsible, they keep working when staff or vendors change.

Vendor security. 873 of the 1,435 incidents in my tracker (60.8%) came through a vendor: an IT contractor, a cloud service, or an outsourced system that held the victim’s data. Stated security standards for the companies that hold other people’s data, and contracts that check those standards are met, would address the majority of incidents in my tracker.

Reasonable, measured consolidation of supply chains. Every extra contractor, subcontractor and handoff is another place for data to leak. Over time, organizations can work with fewer, better-secured vendors and fewer systems holding the same personal data. This needs to be gradual and planned. Ripping out suppliers overnight would create its own outages and gaps, and smaller vendors deserve a path to meeting the standard rather than being dropped.

Patching. A published fix protects nobody until someone installs it. Even ransomware groups get caught by this: when LockBit came back after Operation Cronos, its administrator said the seizure most likely came through his own failure to update PHP. The government has asked for this kind of work before without anyone being required to do it. Clear patching deadlines for critical sectors and government systems, and clear responsibility for who applies each update, protect people without monitoring anyone’s traffic.

None of these is as quick to announce as blocking, and none makes stolen data vanish. Each one shrinks the number of people who wake up to find their details online. Fujii asked what can be done to defend. I’d ask the panel to spend at least as much of its time on these four as on blocking, because they are where defense actually happens.

The tracker has the latest figures, one row per incident with links to every source, and I update it as new notices come out. The full dataset is free to reuse with credit: you can request the CSV from the dataset page, and I send the current release on request.

I post new figures on LinkedIn as the notices come in. If your organization wants a second look at which vendors hold your data, or who applies your updates, you can get in touch.

Matt Ketchum, MKUltraman, Tokyo

Sources

  1. Asahi Shimbun via Yahoo! News Japan, “情報漏洩対策でブロッキングの法的課題を検討 総務省が会議設置” (10 November 2026): https://news.yahoo.co.jp/articles/853648fb4e89cc561f465228602e1145643db4e4
  2. MKUltraman, Japan Cybersecurity Tracker dataset: https://www.mkultraman.com/japan-cybersecurity-tracker/dataset/
  3. MKUltraman, “PHP2Shell: the patch is out. Do you know who installs it?” (21 October 2026): https://www.mkultraman.com/blog/japan-php2shell-patch-who-installs/
  4. PHP, Unsupported Branches (end-of-life dates): https://www.php.net/eol.php
  5. IIJ, Internet Infrastructure Review vol.12, ISP blocking of the most serious illegal content in Japan (August 2011): https://www.iij.ad.jp/en/dev/iir/pdf/iir_vol12_topic_EN.pdf
  6. JPNIC, “インターネット上の海賊版対策に関する検討会議におけるJPNICの提言” (25 June 2018): https://www.nic.ad.jp/ja/topics/2018/20180625-01.html
  7. Ars Technica, “Firefox turns encrypted DNS on by default to thwart snooping ISPs” (25 February 2020): https://arstechnica.com/information-technology/2020/02/firefox-turns-encrypted-dns-on-by-default-to-thwart-snooping-isps/
  8. Palo Alto Networks Unit 42, “Medusa Ransomware Turning Your Files into Stone” (11 January 2024): https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/
  9. The Hacker News, “LockBit Ransomware Group Resurfaces After Law Enforcement Takedown” (26 February 2024): https://thehackernews.com/2024/02/lockbit-ransomware-group-resurfaces.html
  10. Nikkei xTECH, “KADOKAWAが漏洩情報の悪質な拡散に法的措置” (10 July 2024): https://xtech.nikkei.com/atcl/nxt/news/24/01165/
  11. Impress Watch, “KADOKAWA、悪質な情報拡散473件を特定 刑事告訴へ” (12 July 2024): https://www.watch.impress.co.jp/docs/news/1608172.html
  12. Ministry of Internal Affairs and Communications, 通信の秘密（電気通信事業法第4条）FAQ: https://www.soumu.go.jp/main_sosiki/joho_tsusin/d_syohi/th_faq.html
  13. Ministry of Internal Affairs and Communications, constitutional and statutory text of the secrecy of communications: https://www.soumu.go.jp/main_content/000735982.pdf
  14. Safer Internet Association (安心ネットづくり促進協議会), history of blocking the most serious illegal content in Japan: https://www.good-net.jp/investigation/working-group/anti-child-porn_category_112/blocking/prehistory/prehistory_3
  15. Ministry of Internal Affairs and Communications, paper on blocking the most serious illegal content: https://www.soumu.go.jp/main_content/001011315.pdf
  16. Internet Content Safety Association, blocking start announcement (21 April 2011): https://www.netsafety.or.jp/files/110421-blocking_start.pdf
  17. ITmedia NEWS, “海賊版サイトブロッキング問題、弁護士がNTTコムを提訴” (27 April 2018): https://www.itmedia.co.jp/news/article/1804/27/1180427108/
  18. Nikkei, “海賊版「ブロッキング」差し止め請求を棄却 東京地裁” (14 March 2019): https://www.nikkei.com/article/DGXMZO42463420U9A310C1CR8000/
  19. Nikkei, “ブロッキング法制化で大激論、異例の取りまとめ断念” (October 2018): https://www.nikkei.com/article/DGXMZO36529840W8A011C1000000/
  20. Bengo4.com, “「ブロッキングについてはまとまらず」混乱つづいた海賊版対策「座長メモ」の形で報告” (October 2018): https://www.bengo4.com/c_23/n_8767/