Part 1 of a series on Japan’s cybersecurity blind spot. Start with the overview, Japan cyberattacks in 2026: what the breach wave reveals.

Over a period of several weeks, Japanese consumers learned that millions of records had been exposed across car sharing, financial services, cloud storage, retail, and online research platforms. The organizations involved did not all suffer the same technical failure, and the available evidence does not establish a coordinated campaign. Their public announcements nevertheless followed a recognizable form. Each referred to unauthorized access or a cyberattack, described the immediate containment measures, reported contact with police or regulators, and asked customers to remain alert for suspicious email, text messages, or telephone calls. Many also noted that no secondary harm had yet been confirmed. These statements may all have been accurate, but accuracy at the level of incident reporting does not necessarily amount to an explanation of institutional failure.

The word “cyberattack” identifies an unauthorized outcome. It says that somebody outside the approved chain of authority managed to access, alter, remove, or misuse a system or the information it contained. It does not tell us how the person entered, why the route remained available, what privileges followed from the initial access, why abnormal activity was not detected earlier, why the affected information was still being retained, or whether the organization could recover without the attacker’s cooperation. A useful investigation must therefore separate three levels of causation: the unauthorized outcome, the immediate entry mechanism, and the institutional conditions that allowed the incident to become consequential. When those levels are collapsed into a single label, the attacker’s presence becomes the whole explanation and the organization’s operating structure recedes from view.

  1. The unauthorized outcome: what the attacker achieved.
  2. The entry mechanism: how the attacker got in.
  3. The institutional cause: why the route existed and why the result was so large.

The innocent-victim frame

Reporting on a breach usually assigns the organization one uncomplicated role: victim. The company has been attacked by an external criminal, its operations have been disrupted, its employees are working under pressure, and its executives must apologize for harm they did not personally intend. That description is not false. A company subjected to unauthorized access is a victim of the person who committed it, and no responsible analysis should romanticize the intrusion or treat extortion and theft as a legitimate form of accountability. The problem begins when victimhood becomes an exemption from examining causation. Public sympathy moves toward the organization as something weak, unfortunate, and acted upon, even though the same organization designed or approved the system, selected the vendors, assigned the privileges, decided what data to retain, and controlled the budget available for protection.

This framing produces an accountability inversion. The organization with the greatest authority over the conditions preceding the breach is presented chiefly through its suffering after the breach, while customers, employees, and counterparties inherit risks they had little power to prevent. Management can then describe the event as an encounter with a sophisticated outsider rather than as a failure that developed inside an operating structure over time. The two accounts are not mutually exclusive. An attacker may be skilled, persistent, and criminally responsible while the target has also left excessive authority concentrated in one account, retained sensitive information without a continuing purpose, failed to segment systems, or treated detection as a product rather than an exercised capability. Victim status establishes that a wrong was committed against the organization. It does not establish that the resulting scale of damage was unavoidable.

Nor are the relevant expectations recent inventions imposed retrospectively after a new kind of attack. The Information-technology Promotion Agency (IPA), an agency under Japan’s Ministry of Economy, Trade and Industry that publishes national IT security guidance, was already telling Japanese organizations in 2009 that management should define and communicate information-security policy, users should apply software patches promptly, administrators should monitor new threats continuously, and developers should build systems with security in mind. Its 2010 guidance explicitly discussed access control, proactive prevention, incident response, business continuity, and the responsibilities of corporate managers and system administrators. The ministry itself, METI, now describes cybersecurity management as applicable across sectors and company sizes and states that management must be involved before attacks and incidents occur. This history does not prove that any particular breach resulted from a knowingly ignored warning, and it should not be used to invent negligence where the technical evidence remains incomplete. It does establish that the basic managerial problem has been recognized for many years. Organizations have had repeated opportunities to treat cybersecurity as an operating responsibility rather than an emergency expense incurred after public failure.

Administrative access and delegated authority

Scala, a Japanese software company, provides one example in its October disclosure. Its i-ask system handled customer enquiries for several corporate clients, including Daiwa Securities. According to the company, a third party logged into the i-ask administrative site on the evening of October 2, installed an unauthorized program on a Scala-managed server, and may have obtained enquiry information from databases belonging to as many as five client companies. The server contained up to 713,126 enquiry records. Scala responded by changing the password associated with the account used in the intrusion, changing all administrator passwords, isolating the unauthorized program, and modifying the system so that uploaded files could not be executed as programs. These measures do not, by themselves, establish the original cause. They do identify several controls that became urgent after the intrusion and therefore define the subjects a serious post-incident investigation would need to examine.

The unanswered questions are administrative rather than cinematic. Investigators would need to determine how the login credential was obtained, whether multifactor authentication was required, why the account could install or enable executable code, how multiple client environments were separated on the same server, and whether the activity generated alerts before the company intervened. None of those questions diminishes the attacker’s responsibility. They concern the authority that the organization had granted to an administrative identity and the safeguards surrounding its use. An administrator account is not merely a password. It is delegated institutional power, often capable of changing software, reading customer information, and affecting more than one client. Security therefore depends not only on keeping the password secret but also on limiting what the account can do, requiring stronger proof of identity, recording its activity, and making anomalous use visible.

A rusted iron gate chained shut in front of a closed white door
Photographed in 2013. Image via cogdogblog on Wikimedia Commons (CC0).

Rakuten Drive, the cloud file-storage service run by the Rakuten group, disclosed a related but distinct failure of privileged access. A third party obtained credentials for an administrative account used by part of the service, and Rakuten confirmed access to files belonging to 15,382 accounts over a period extending from January 29 to September 17. Smaller groups also had profile information and password-related data accessed. The notice establishes that an administrative credential was compromised and describes the information reached, but it does not publicly establish how the credential was acquired, who used it, or whether the incident was connected to a separate malicious push-notification event reported earlier in the year. Those facts remain unknown, and responsible analysis should not fill the gaps with a more dramatic story than the evidence supports. The absence of a complete forensic account, however, does not make the administrative questions disappear. The long period of access raises questions about how privileged activity was authenticated, constrained, and monitored, whether one account could inspect large numbers of user files, and what patterns of access were considered sufficiently abnormal to warrant intervention.

Public discussion often treats a stolen credential as though it were the digital equivalent of a copied key. That analogy is incomplete because digital authority can be designed with far more constraints than a physical key. It can require a second factor, expire quickly, operate only from approved devices or networks, permit access to only a defined subset of information, and trigger review when behavior departs from an established pattern. When a compromised administrative identity remains useful for an extended period or reaches thousands of users, the relevant inquiry extends beyond the moment of theft. It includes the structure of the authority attached to the account and the organization’s capacity to observe how that authority is exercised.

When the customer becomes part of the detection system

The incident at GMO Research & AI, the company behind the infoQ online survey site, illustrates a different pattern. The company reported that an attacker exploited a vulnerability in software used by the survey site. Up to 948,498 member records were taken, and points belonging to 611 members were converted into Amazon gift codes worth ¥2,869,500. Unauthorized access began on October 2. On the morning of October 3, an enquiry from a member prompted an investigation. GMO stopped point exchanges at 11:24, blocked the attack route at 14:15, and cut off external access at 15:00. Before the nature of the incident was publicly described, the interruption appeared to users as “emergency maintenance.” The published timeline does not prove that the company had no automated warning, nor does it establish that a customer personally discovered the intrusion. It does establish that a member enquiry preceded the company’s confirmed operational response.

The technical description is careful but limited. GMO identified exploitation of a software vulnerability without naming the product, vendor, version, CVE, or patch status. On the public evidence, it would therefore be inaccurate to describe the incident as a zero-day attack. The vulnerability may have been previously unknown, publicly documented but unpatched, introduced through deployment, or connected to some other condition that has not been disclosed. “A software vulnerability was exploited” marks the present limit of the evidence rather than an invitation to invent the missing forensics. Even within that limit, however, the incident demonstrates more than a loss of confidentiality. The intruder reached an operational system, understood that customer points could be converted, and used the organization’s own functions to produce immediate monetary value before containment. This was not simply a matter of records being copied for hypothetical future use. The affected service itself became the mechanism through which value was extracted.

That distinction matters because many security programs are evaluated through the presence of products and procedures rather than their demonstrated ability to detect harmful activity. An organization may own monitoring software, collect logs, commission periodic assessments, and still depend on a customer complaint to make an incident operationally visible. The decisive question is not whether logs exist but whether someone reviews the right signals, understands the service well enough to recognize misuse, and has authority to intervene. Detection is a management capability supported by technology. It cannot be reduced to purchasing a monitoring system or recording events that nobody examines until after money or information has already left the organization.

NTV’s report, in Japanese, covers the infoQ breach and the point fraud. Video: 【情報漏えい】「GMO｣グループ会社で不正アクセス 会員ポイントの不正交換も 相次ぐ情報漏えいに経済界も警鐘｢攻撃者がAIを積極的に…」 from 日テレNEWS.

Organizations discover their holdings after somebody takes them

The recent incidents also reveal failures of information governance. Times Car, the car-sharing service, confirmed that approximately 6.6 million accounts had been taken from its web system. The affected population included current members, former members, and people who began an application but never completed it. The exposed information varied by account and included names, addresses, dates of birth, telephone numbers, email addresses, driving-licence information, and passwords stored in what the company described as a non-reversible form. The following day, Times confirmed that approximately 1.6 million accounts included images of identity documents, including driving licences, utility bills used to establish current addresses, student identification, and documents used to establish family relationships. The first question is how the attacker entered. The next is why this volume of identity material remained available within one compromised environment, particularly when the affected population included former members and abandoned applicants.

Information has a lifecycle, even when an organization behaves as though storage were permanent and costless. A document may have a legitimate purpose when it is collected, such as confirming that an applicant holds a licence or resides at a particular address. Once that purpose ends, continued retention creates risk without necessarily creating corresponding value. A driving-licence image contains biographical information that cannot be conveniently changed after exposure. A utility bill may connect identity to a current address, while family documents may reveal relationships useful for impersonation or social engineering. The institutional question is therefore not confined to perimeter security. It includes whether the organization needed to preserve reusable copies of the documents, how long each category was retained, who could retrieve it, whether former-customer and incomplete-application data were deleted, and whether proof of successful verification could have been retained instead of the underlying image.

HIS, the Japanese travel agency, provides an even clearer example of an organization learning the content of its own systems only after an intrusion forced the issue. Its Thai subsidiary detected suspicious access to a file server on December 11, 2025. By February 24, 2026, investigators had identified passport information belonging to as many as 627 customers. HIS did not publicly disclose the incident until October 7, which was 300 days after the original alert and 225 days after investigators had identified the possible passport exposure. The company explained that unrelated accounting records and personal information were mixed together across varied file formats and storage conditions. Automated processing and search were insufficient, so staff had to inspect and reconcile the material manually.

The delay is important, but the underlying governance problem is more revealing than the number of elapsed days. HIS formally possessed the files but lacked a readily usable inventory of their content, ownership, and affected individuals. This made the breach difficult to measure and the notification population difficult to identify. A system can therefore be under institutional custody without being under functional control. When organizations cannot say what information a server contains, why it remains there, who is responsible for it, and how quickly affected people can be identified, the attacker is not the only source of uncertainty. The institution has allowed its own information environment to become opaque. The intrusion merely exposes that opacity under conditions of public consequence.

ANN’s report, in Japanese, covers the HIS disclosure. Its headline rounds the figure to 620; the body gives HIS’s maximum of 627. Video: HIS子会社　最大620人余のパスポート情報漏えいか　タイにある子会社に不正アクセス(2026年10月7日) from ANNnewsCH.

The transfer of work from company to customer

Breach notices usually conclude with advice. Customers are told to watch for phishing, avoid suspicious attachments, distrust unexpected messages, and contact the police if they encounter impersonation or threats. MrMax, a discount retail chain, followed this pattern after reporting that someone had misused a function of software supporting its app and online store to enter company servers. Up to 1,735,154 members may have had member IDs, names, email addresses, and telephone numbers exposed. MrMax blocked external access, stopped the affected services, notified the authorities, and warned customers about possible impersonation and phishing. These precautions are reasonable, but they also reveal where a substantial portion of the continuing burden is placed after the company has lost control of the information.

ANN’s report, in Japanese, covers the MrMax disclosure and its warning about phishing. Video: 最大約174万人の個人情報が流出 ミスターマックスに不正アクセス(2026年10月6日) from ANNnewsCH.

The company collected the data, selected or commissioned the software, governed the server, and established the relationship with its vendors. Once the information escaped, the customer acquired a new and unpaid form of risk management. The individual must decide whether the next plausible message from a familiar brand is genuine, whether a caller already knows enough personal information to appear legitimate, whether a compromised password has been reused elsewhere, and whether an unexplained transaction indicates fraud. A stolen customer record is valuable not only as a row in a database but as raw material for a convincing approach. A message referring accurately to Times Car identity verification, a MrMax membership, or a Rakuten Drive account can exploit the context created by the original breach. “No secondary harm has been confirmed” means only that confirmed misuse has not yet been established within the organization’s present field of view. It does not establish that the information is harmless or that customers have returned to their previous level of risk.

This transfer of responsibility is especially severe when the exposed information cannot be revoked. A password can be changed and a credit card can be cancelled. A person cannot conveniently replace a face, date of birth, family relationship, or history of residence. The Times Car incident therefore extends beyond the systems from which the images were taken. It affects every later process willing to accept those images as evidence of identity. Even if the organization blocks the original access route, the copied document remains available to whoever obtained it, while the victim must continue to monitor for misuse. The technical incident may be contained, but the social and administrative consequences can persist long after the attacker has left the server.

Cybersecurity as institutional custodianship

None of this excuses the attacker. Unauthorized access, data theft, extortion, and fraud remain the responsibility of the people who commit them. An organization can nevertheless be both the victim of an intrusion and the custodian of systems it failed to govern adequately. Victimhood describes the organization’s relationship to the criminal act; it does not evaluate the quality of its management before that act occurred. The attacker is responsible for the unlawful intrusion. The institution remains responsible for the conditions under its control, including what it retained, who could reach it, how privileged access was constrained, whether vendors were supervised, whether unusual activity was visible, whether systems and customers were separated, whether recovery had been tested, and whether years of published guidance had been converted into ordinary operating practice. Sympathy for the victim should not become analytical immunity for the custodian.

Treating “cyberattack” as a complete explanation makes every incident appear exceptional. A mysterious outsider arrives, something unfortunate happens, the company hires a specialist, senior management apologizes, and monitoring is promised. The next organization then issues a substantially similar notice. The pattern is not that every incident has the same attacker, motive, or entry mechanism; the evidence does not support such a conclusion. The pattern is that technically different intrusions repeatedly expose weak control over ordinary administrative functions: credentials, software, vendor relationships, retained information, server boundaries, detection, and recovery. These are not purely technical matters delegated to an isolated security department. They are management systems expressed through technology.

Japan’s immediate problem is therefore larger than the number of hackers targeting its institutions. It is a problem of custodianship. Organizations collect sensitive information and operate systems of considerable consequence without always maintaining a functional account of what they possess, why they possess it, who can act upon it, and how misuse would be detected. The companies discussed here are recognizable organizations with access to professional vendors, legal advice, and substantial resources. Their failures are publicly visible because the scale is large, the brands are familiar, and the incidents eventually require disclosure. Part 2 examines what this implies for the 99.7 percent of Japanese businesses classified as small and medium-sized enterprises, many of which inherit the same technologies and management habits without comparable staffing, specialist knowledge, or capacity to survive a serious failure.

If your organization cannot quickly say who holds administrative authority over its systems, what personal data it retains, and why, a Diagnostics review maps that before an incident forces the question. If you want to start with what is already visible from outside, my external exposure check reviews up to three of your domains for a fixed price.

Sources