Part 4 of a series on Japan’s cybersecurity blind spot. Start with the overview, Japan cyberattacks in 2026: what the breach wave reveals, or read Part 1, Part 2, and Part 3.

14.64 million customer records at Skyticket. Data from about 6.6 million accounts at Times Car. 2.16 million records at Lawson. Attackers are hunting in Japan, and there is blood in the water.

Skyticket, the travel-booking service run by Adventure, Inc., disclosed that about 14.64 million customers’ names, birth dates, email addresses, phone numbers, and addresses leaked after someone used parts of its administrative functions. Times Car, Park24’s car-sharing service, confirmed that information from about 6.6 million accounts was taken, including identity-document images such as driving licences for about 1.6 million accounts. Lawson, the convenience-store chain, reported unauthorized access to about 2.16 million customer records. JR East, the East Japan Railway Company, said up to about 2.06 million Ekinet and Otona no Kyujitsu Club member records, mostly email addresses, may have been exposed through an outside email service affected by the ransomware attack on the cloud platform of IDC Frontier, a SoftBank data-center subsidiary. Counting its card arm, View Card, the group put the figure at about 6.09 million. Nobody has shown that these incidents are connected, and where the cause is public, they failed in different ways.

Nippon TV’s report, in Japanese, covers JR East’s disclosure that its member-email system was reached through the IDC Frontier intrusion. Video: 【速報】えきねっと会員と大人の休日倶楽部会員に電子メールを送るシステムにも不正アクセス 個人情報漏えいの可能性 JR東日本 from 日テレNEWS.

Most root causes are not public, so nobody outside these organizations can say exactly how each one was breached, or which specific control would have stopped it. Two things are known. When JPCERT/CC, the Japan Computer Emergency Response Team Coordination Center, warned about this autumn’s run of breaches, the first attack pattern it described was not exotic: attackers scanning each target for known vulnerabilities and exposed files. And Skyticket confirmed one incident that needed no hacking at all. Its bus-booking confirmation pages could be opened without logging in, and someone harvested about 12,000 bookings with an automated script for two months before the company noticed.

Much of the coverage treats the victims as if compromise was inevitable: a sophisticated attacker arrived, so the damage followed. For many organizations, the more accurate description is that attackers went looking for weaknesses that were easy to find, and found them. This article is about the environment these attacks land in: basic weaknesses that are common in Japan, visible from the outside, and mostly not hard to fix.

What anyone can see

You do not need privileged access to form a view of an organization’s technical discipline. A great deal is public, and free tools such as EasyDMARC let anyone look up a domain’s email authentication in seconds. Across Japanese companies, the basics anyone can check from the outside are routinely neglected, basics like:

  • email authentication (SPF, DKIM, and DMARC) that stops at the first step;
  • a CMS and plugins several versions behind;
  • administrative login pages open to the internet;
  • login forms that cap passwords at sixteen characters or ban symbols;
  • former staff and vendors who still have access;
  • domains, DNS, and cloud accounts held by a vendor nobody has called in years;
  • English pages that have not been touched since launch.

Checking most of this requires no intrusion at all. It is the same information any customer, partner, or attacker can read.

Running these checks is part of the work I do with clients. Before recommending changes to a company’s technology stack, I look at what the outside world can already see, because it shows quickly where administration has lapsed and what needs attention first. When I run the same checks on Japanese companies more widely, the results are all over the place.

As a mental exercise, imagine a company with a typical set of email settings. Its main domain publishes an SPF record and DKIM keys, but the SPF rule ends in a soft setting that receivers treat as advisory. Its DMARC policy is p=none with no reporting address, which means it is not blocking spoofed mail and is not collecting the reports that would tell it who is sending in its name. A corporate subdomain has no SPF record at all, and with no subdomain policy set, it inherits the same p=none. A domain set up this way is in monitoring mode with nobody monitoring. This is not a contrived case. It is a combination I find regularly.

None of that proves the company has been compromised or will be. It does tell you something about how its systems are administered, and those signals rarely appear alone.

Large mounted binoculars on a ship's deck at sunset, with a helicopter and an aircraft carrier reflected in the lenses
Ship-mounted binoculars on the USS Harry S. Truman, photographed in 2005. Image via U.S. Navy photo by Airman Ricardo J. Reyes on Wikimedia Commons (public domain).

Triple damage

Each of these issues is minor on its own. Together they do damage three times over.

The first cost is operational, and it arrives every day whether or not anyone attacks. Outdated systems waste time and energy. Staff build manual workarounds around tools that no longer fit, mail that should reach customers lands in spam, and nobody can change the website without calling a vendor. That is more work for less profit, attack or no attack.

The second is direct risk. Each gap is a way in. An unpatched CMS, an exposed login page, and a former vendor’s account are separate doors, and an attacker only needs one.

The third is what the gaps say together. They stack: an old CMS with an exposed login page and a former vendor’s account still active is a much easier target than any one of those alone, and the combination sends a signal. A company that has not maintained the parts anyone can inspect has probably not maintained the parts nobody can: patching, backups, monitoring, and who holds administrative rights. The visible neglect is the blood a shark smells from a mile away. An attacker cannot see every internal weakness from outside, and does not need to. The outside is enough to conclude that this one is weak and probably easy to get into.

Password rules are a good example of how plainly the signal shows. NIST, the US National Institute of Standards and Technology, recommends allowing passwords of at least 64 characters and has dropped composition rules entirely. A login form that still enforces short limits is advertising an old system.

That inference scales. If Japanese companies are consistently weak on the visible basics, it is reasonable to expect that many are weak on the invisible ones, and that the country as a whole offers attackers a large pool of rewarding targets. Proofpoint, an email-security company, reported that 82.8 percent of the new email attack types it observed worldwide in 2025 targeted Japan. Generative AI has removed much of the protection the Japanese language once provided. The risk was already there, and it is now being acted on.

FNN’s report, in Japanese, follows one man from a convincing fake card-company email to fraudulent charges on his account. Video: 個人情報「どこまで漏れたか恐怖」AIで巧妙化する詐欺メール　文面クリックしたところクレカに不正請求　銀行からアプリ振り込み上限額で保留の連絡も（2026年10月06日） from FNNプライムオンライン.

The national picture

Email authentication is not the cause of these breaches. It is the one item on that list with reliable national data, and the data shows the pattern clearly: companies publish the record and stop before it protects anyone.

Proofpoint found that 92 percent of Nikkei 225 companies had a DMARC record in July 2026, but only 43 percent enforced it with quarantine or reject. The Fortune 1000 figure was 83 percent. In Proofpoint’s December 2025 comparison of the largest listed companies in 18 countries and regions, Japan ranked last for enforcement. TwoFive, a Japanese email-security firm, found that only 18.5 percent of the 9,301 domains operated by Nikkei 225 companies were actually protected by an enforcing policy once inherited subdomain settings were counted.

Smaller companies have no dedicated survey, but the Ministry of Internal Affairs and Communications (MIC) publishes a monthly count of JP domains. Of the roughly 471,000 co.jp company domains that receive mail, about 92.5 percent publish SPF, 39.5 percent publish DMARC, and 5.7 percent enforce it. Those figures count records, not working records. An SPF record can exist and still miss the services that actually send the company’s mail, exceed SPF’s ten-lookup limit, or end in a soft rule. The imagined company above would count as covered.

The pattern extends beyond email. In a 2026 study of 126 SMEs’ externally visible systems, Japan’s Information-technology Promotion Agency (IPA), the government’s IT and security body, found exposed administrative login pages at 18 companies and deficient email-authentication records at 112. That was a small diagnostic sample, not a national rate, but the weaknesses were concrete.

The inverted market

Reconnaissance has become so cheap that it barely has a price. Search engines for internet-connected systems scan continuously, and email-authentication records are public by design. An attacker does not need to buy a list of companies with exposed login pages or unenforced DMARC; they can generate one in an afternoon. The criminal market has moved further down the chain, to brokers who sell access to networks that have already been breached.

The defenders have the same information. Every check an attacker runs, a company can run on itself for free, in seconds. It has every reason to: it is the one that will lose customer data, revenue, and trust. Most do not look anyway. Some assume they are too small or too obscure to be targeted. Some assume the vendor who built the site years ago is still looking after it. Some treat systems that have not failed yet as systems that work. The result is an inversion: the people who want to exploit a weakness can see it clearly, and the people with the most to lose from it often have no idea it exists. Closing that gap does not require new technology. It requires someone inside the company to look, and to take what they find seriously.

Compromise was not inevitable

Attackers are responsible for their attacks. That does not make every outcome fixed in advance.

Most criminal intrusion is opportunistic. Scanning, credential testing, and known-vulnerability exploitation work at scale because they let attackers sort targets by how little effort each one requires. Basic controls do not make an organization immune, but they raise the cost of attacking it and push it down the list. We do not know which of this autumn’s victims would have been spared by better hygiene. It is reasonable to conclude that organizations running current software, enforced email authentication, multi-factor login, and a short list of administrators were at lower risk and were less attractive targets than organizations without them.

The government’s own advice reflects this. On October 9, Japan’s National Cybersecurity Office, part of the Cabinet Secretariat, asked companies holding large volumes of personal data to apply patches promptly, stop using unsupported software, remove unused systems, require multi-factor authentication, disable old accounts, inventory suppliers, and delete data they no longer need. None of that is new technology. It is maintenance that many organizations deferred.

TBS’s report, in Japanese, covers the October 8 meeting at which the cybersecurity minister called the situation critical. Video: 「危急の状況」サイバー攻撃による個人情報漏えい受け関係省庁会議開催 古川サイバー安全保障担当大臣が事業者に対策強化要請へ｜TBS NEWS DIG from TBS NEWS DIG Powered by JNN.

Why the basics stall

Part of the explanation is practical. Moving DMARC from monitoring to enforcement means finding every service that sends mail in the company’s name and fixing each one, and nobody wants to be responsible for blocking a client’s email. Part is ownership. When the domain, DNS, mail platform, website, and marketing tools are managed by different vendors, nobody inside the company may have the authority or knowledge to coordinate them. Part is how success is measured. If the goal is having a record, a policy, or a certificate, the work ends the day it is published.

The government has pushed in places. In 2023, MIC, the National Police Agency, and the Ministry of Economy, Trade and Industry asked credit-card companies to deploy DMARC with a reject policy. After the October breaches, the Financial Services Agency, Japan’s financial regulator, asked banks to stop verifying customers with photographs of identity documents. For most companies, though, the push came from Gmail, Yahoo, and Microsoft sending requirements, and those rules reward publishing a record rather than enforcing one.

The fixes are mostly easy

This is the part the coverage misses. Much of the work that reduces exposure is ordinary administration, and much of it can be done in days rather than budget cycles:

  • Find out who controls the domain, DNS, email, website, and cloud accounts, and put them under company-owned accounts with multi-factor authentication.
  • Publish an SPF record that lists the services that actually send mail, sign outgoing mail with DKIM, add a DMARC reporting address, read the reports, and move to quarantine and then reject.
  • Update the CMS and its plugins, or move a neglected site to a maintained platform, and take administrative login pages off the open internet.
  • Allow long passwords, drop composition rules, and require multi-factor login.
  • Remove former staff and vendors, and delete data that no longer has a purpose.

The same work improves productivity. Properly authenticated mail is more likely to reach customers’ inboxes. A maintained website and clear account ownership make changes faster and handovers less painful. Fewer manual workarounds mean fewer mistakes.

Many Japanese organizations could have done this years ago. Some did not because nobody asked them to, and some because nobody owned the job. The useful conclusion from this month is not that breaches are unavoidable. It is that a large share of the risk sits in work that is cheap, well documented, and available to any company that decides to do it.

I check the full list above, not only email, as a fixed-price external exposure check: up to three domains, ¥100,000 + tax, a written report within five business days, and a 30-minute debrief. It uses only public information, the same view any customer, partner, or stranger already has, and involves no testing of your systems.

These checks are where my Diagnostics review begins: what anyone can see from outside, then what that says about the systems behind it. The Digital Baseline is the implementation step that puts domains, email authentication, accounts, and backups under company control. For the wider argument about what control looks like once the basics are in place, read What functional cybersecurity control looks like in Japan.

The next part, You outsourced the work, not the responsibility, follows the breaches that came in through vendors and cloud providers.

Sources