Digital transformation, paper and legacy systems in Japan
The 99.7% problem: Japan's SME cybersecurity exposure
SMEs are 99.7 percent of Japanese businesses. What visible breaches at large companies imply for the much larger, less visible small-business attack surface.
Part 2 of a series on Japan’s cybersecurity blind spot. Start with the overview, Japan cyberattacks in 2026: what the breach wave reveals.
The companies in the first part of this series were visible. They had recognizable brands, large customer populations, formal corporate communications, access to specialist vendors, and incidents serious enough to require public explanation. Their failures produced numbers that journalists could place in headlines: millions of accounts, hundreds of thousands of enquiries, months of unauthorized access, and hundreds of days between detection and disclosure. That visibility can distort the diagnosis by encouraging us to imagine cybersecurity as a contest between sophisticated criminals and prominent corporations, while the rest of the economy watches from outside the arena. The rest of the economy is already inside it.
Small and medium-sized enterprises account for 99.7 percent of Japanese businesses. That statistic does not mean that 99.7 percent of Japanese companies are insecure. It does mean that any account of Japan’s cybersecurity condition that concentrates on major listed companies is describing a small and unusually observable part of the operating environment. The overwhelming majority consists of manufacturers, wholesalers, retailers, professional firms, software companies, clinics, contractors, logistics operators, hospitality businesses, and local service providers whose systems may be less visible but whose failure can still stop production, expose personal information, interrupt a larger customer’s operations, or provide a route into somebody else’s network.
The 99.7 percent figure is therefore not a rhetorical synonym for vulnerability. It is a denominator. The problem is what happens when that denominator is combined with low investment, weak organizational preparation, dependence on shared providers, and an incident-reporting system that reveals only part of the damage.
The incidents we see are selected, not representative
Large-company breaches become public for understandable reasons. A listed company may face disclosure obligations, a familiar consumer brand attracts press attention, a large affected population creates political and regulatory pressure, and a well-staffed organization is more likely to investigate the event, count the records, consult counsel, and publish a formal notice. None of this makes major companies uniquely vulnerable. It makes their failures visible.
The SME environment is harder to observe. A small company may detect an intrusion only after its systems stop, a customer complains, its bank identifies fraud, or an attacker makes an extortion demand. It may restore whatever it can, call its IT supplier, and never publish a notice that enters a searchable public record. If the company cannot reconstruct its logs, does not know what information was accessible, or treats the disruption as an isolated technical problem, the incident may never become a measured security event at all. Public silence can therefore mean that nothing happened. It can also mean that the organization did not detect the intrusion, could not determine its scope, had no practical reporting channel, feared the commercial consequences of disclosure, or ceased operating before producing a useful account.
This is why headline counts must be interpreted cautiously. They are evidence of recorded incidents, not a census of successful attacks. Japan’s National Police Agency recorded 226 ransomware cases in 2025. Its breakdown attributed 143 of those reports, roughly six in ten, to SMEs, compared with 64 involving large enterprises and 19 involving other organizations. That does not establish that an individual SME is more likely to be attacked than an individual large company; the underlying populations are radically different, and detection and reporting behavior may also differ. It does establish that SME ransomware is not a hypothetical edge case. Small and medium-sized companies form the majority of reported victims even within a dataset that necessarily captures only incidents known to police.
The recovery data are more severe than the incident count alone. Among organizations responding to the police survey, more than half reported total investigation and recovery costs of at least ¥10 million, while only a little more than half had recovered within one month. Those figures cover organizations of different sizes and should not be treated as an SME-only cost estimate. Their business meaning is nevertheless obvious. A large corporation may absorb emergency consultants, legal work, lost sales, overtime, system reconstruction, and a month of impaired operations as a serious but survivable shock. For a small supplier with concentrated customers, limited cash reserves, and no substitute operating environment, the same event can become an existential one.
Six in ten invested nothing
The clearest evidence of the preparation gap comes from a 2024 survey of 4,191 SME executives and information-system managers by the Information-technology Promotion Agency (IPA), an agency under Japan’s Ministry of Economy, Trade and Industry that publishes national IT security guidance. Asked about information-security investment over the preceding three fiscal periods, 62.6 percent reported no investment at all. Among that group, 44.3 percent said they did not feel investment was necessary, 24.2 percent said the cost-effectiveness was unclear, and 21.7 percent said the cost was too high.
These answers should not be caricatured as simple ignorance. A small business faces real constraints. Security competes with wages, rent, equipment, debt service, recruitment, compliance, and immediate customer demands. Specialist advice can be expensive, security products can be difficult to evaluate, and a proprietor may be asked to buy protection against a probabilistic loss while confronting certain expenses every month. The return on a prevented incident is also difficult to display: nothing happens, no crisis becomes visible, and the expenditure can appear to have produced nothing.
But the absence of investment is still an operating decision, even when it arises from constraint rather than indifference. Email, cloud storage, accounting software, remote access, websites, customer databases, booking systems, and supplier portals create dependencies whether or not the company has chosen to describe itself as a digital business. The same IPA survey found that 73.0 percent of respondents said they fully or partially kept operating systems and software current, and 71.4 percent said the same of antivirus software and definitions. Organizational controls were much weaker. Only 39.8 percent fully or partially reported preparing emergency structures and procedures for a security incident, 39.2 percent had formalized and communicated security rules, and 37.9 percent had a mechanism for learning about new threats and sharing countermeasures internally.
Software updates and antivirus products are necessary, but they are not a management system. An organization also needs to know who owns each service, who can make administrative changes, which suppliers have access, what information is retained, which operations must continue during failure, how an incident will be detected, who has authority to disconnect a system, where usable backups exist, and how customers and counterparties will be informed. When these responsibilities remain informal, the business has not avoided security administration. It has merely left that administration to emerge under pressure after something breaks.
Attackers do not need to respect the company hierarchy
The common reassurance that a business is “too small to target” misunderstands the economics of contemporary intrusion. Attackers do not need to select every victim through bespoke research. Internet-facing systems can be found at scale. Stolen credentials can be tested automatically. Known vulnerabilities can be scanned for across large address ranges. Ransomware-as-a-service allows people without the ability to develop their own malware to obtain infrastructure, tools, and support from a criminal operator. The National Police Agency reports that recent ransomware intrusions have predominantly begun through internet-exposed points rather than malicious email attachments and that VPN equipment accounted for more than 60 percent of identified entry routes in its victim survey. It describes attackers exploiting unpatched vulnerabilities, leaked credentials, weak passwords, and configuration errors before seeking administrative control, disabling defenses, locating valuable data and backups, and moving information out of the network.
A small company does not have to be famous for this model to work. It needs only to expose a reachable weakness that is cheap to discover and profitable to exploit. The attacker’s calculation may have little relationship to the victim’s prestige. The relevant questions are whether access can be obtained, whether useful authority follows, whether the victim can be pressured, and whether the compromise creates access to additional organizations.
This changes the meaning of an SME’s security posture. A company may hold few consumer records and still operate a privileged connection to a major customer. It may manage a website for a municipality, maintain software used by larger businesses, distribute email on behalf of clients, administer devices inside customer environments, or store credentials that grant access to a more valuable system. Its own revenue may be modest while the authority entrusted to it is substantial. The harm from compromise is then determined not only by the size of the company but by the dependencies attached to it.
The IPA survey makes that outward effect visible. Of the 4,191 respondents, 975 reported that they had experienced, or probably experienced, at least one cyber incident during fiscal 2023. Among those 975 respondents, approximately seven in ten identified some effect on business partners. Service interruption, delay, or lost income was reported by 36.1 percent, and compensation burdens involving individual or corporate customers were reported by 32.4 percent. These are self-reported survey results, not independently verified incident files, and they should not be extrapolated mechanically to every Japanese SME. They nevertheless contradict the idea that a small company’s security failure remains contained within that company. The effects travel through commercial relationships.
The inherited-risk problem
SMEs also inherit risk from systems they do not control. Cloud services, managed hosting, email platforms, payment providers, software-as-a-service products, and outsourced administrators allow smaller organizations to use capabilities they could not economically build alone. That concentration is often rational. A professional provider may have more technical staff, better equipment, and stronger routine controls than any one customer could maintain. Outsourcing can reduce risk, but it does not abolish dependency. It changes where the dependency sits.
The October 2026 compromise of IDCF Cloud, operated by the Japanese data-centre company IDC Frontier, demonstrated the scale of that distinction. IDC Frontier said that ransomware-related unauthorized access affected part of East Japan Region 1 and placed 495 corporate and municipal customers within the incident’s impact scope. The company later reported that virtual servers in four zones had stopped and could not be restarted, that customer data in those zones would be difficult to retrieve or restore, and that restoration appeared possible only from backups held by the customers themselves.
The figure of 495 must be handled precisely. It does not mean that attackers separately penetrated 495 customer networks, that data were stolen from all 495 organizations, or that every customer suffered the same loss. It describes the customer population exposed to one provider-level failure. The incident matters here because hundreds of organizations can make individually reasonable decisions to rent infrastructure from one supplier and still become participants in a shared failure domain. A small company may patch its own application, control employee accounts, and follow ordinary security guidance yet remain unable to restart because the underlying virtual server and storage layer have failed. If its only usable backup occupies the same provider, region, administrative plane, or set of credentials, the apparent backup may be another component of the same dependency rather than a route out of it.
ANN’s report, in Japanese, shows what the IDCF outage meant for customers: frozen-food shipments stopped and a childcare booking app went offline. Video: ソフトバンク子会社に「ランサムウェア」サイバー攻撃 約500の企業や自治体に影響(2026年10月8日) from ANNnewsCH.
This does not prove that IDC Frontier conducted no security audit or penetration test. It does not establish the original entry route, the scope of any prior testing, the findings produced, or whether remediation occurred. A test can be well performed within a limited scope and still miss the eventual path. What the incident does establish is that the complete assurance regime, including prevention, monitoring, segmentation, containment, backup architecture, and recovery, did not stop one provider compromise from creating a large cross-sector operational blast radius. The distinction between possessing controls and surviving their failure is not academic when customers are told to rebuild elsewhere from whatever independent backups they happen to hold.
Buying technology is not governing a dependency
The SME security market often offers products because products are easy to specify and sell. A business can buy endpoint protection, a firewall, a cloud subscription, backup storage, cyber insurance, or a monitoring service. Each may reduce risk. None answers the managerial question of how the pieces work together when an administrator account is compromised, a provider fails, a backup cannot be restored, a contractor disappears, or an incident begins outside normal business hours.
This is where low investment and outsourcing interact dangerously. A company that lacks internal expertise may rely heavily on an outside vendor. Because it lacks internal expertise, it may also be unable to evaluate the vendor’s architecture, challenge vague assurances, inspect whether alerts are being reviewed, verify backup independence, or test whether recovery works. The supplier becomes both operator and source of reassurance. Contracts may specify availability in normal conditions without establishing who owns incident evidence, how quickly the customer must be notified, whether subcontractors are disclosed, how data can be extracted, or how the service will be rebuilt somewhere else. The company has purchased administration without retaining the capacity to govern the administrator.
The answer is not that every SME must create the security department of a major bank. That would be economically impossible and, in many cases, operationally absurd. The relevant standard is proportional control: understanding the systems on which the business depends, restricting administrative authority, requiring strong authentication, applying security updates, maintaining recoverable copies outside the principal failure domain, preserving sufficient logs, assigning an incident owner, testing a realistic restoration path, and requiring important suppliers to state what they will do when their own systems fail. Some of this work can and should be shared through qualified managed services. What cannot be outsourced is the decision about what level of interruption, data loss, and dependency the business is willing and able to survive.
The IPA survey also challenges the claim that security is only a cost. Among respondents that had received security requirements from customers, 59.8 percent of companies with a designated security department or person said that implementing requested measures had been an important factor in winning business. The equivalent figure among companies that left security to individual discretion was 24.2 percent. Among companies with ISMS certification, 73.9 percent said requested security measures had contributed importantly to winning business, compared with 30.3 percent among companies without it. These figures reflect the perceptions of a subset of surveyed companies rather than audited revenue attribution, but they show why security can function as market infrastructure. A buyer that can distinguish governed suppliers from merely connected ones can reward preparation before an incident rather than punish failure afterward.
Certification alone is not proof of secure infrastructure, and a questionnaire alone is not assurance. A company can possess an assessed management system and still be compromised. A vendor can answer “yes” to backup, testing, monitoring, and access-control questions while implementing each control narrowly or ineffectively. Requirements acquire commercial value when they are connected to evidence: named responsibility, current system inventories, multifactor authentication for privileged access, independent recovery copies, restoration records, remediation of serious findings, incident-notification commitments, and a practical exit route from a failing provider. This makes consequential dependencies inspectable instead of merely adding paperwork.
The part of the problem that does not make the news
Japan does not have an SME cybersecurity problem because small companies are uniquely careless. It has one because almost the entire business population operates under conditions in which expertise, money, bargaining power, and recovery capacity are unevenly distributed, while exposure is increasingly shared. A vulnerable remote-access device at one factory, an overpowered administrator at one service company, or an unrecoverable workload at one cloud provider can affect customers and counterparties that never made the original technical decision.
The visible incidents at major companies are therefore not reassuring exceptions. They are demonstrations conducted by organizations capable of eventually counting the damage and publishing it. If companies with professional vendors, legal advisers, and formal management structures can retain information they cannot quickly inventory, grant administrative authority they cannot adequately observe, or discover that recovery depends on assumptions never tested under pressure, the reasonable inference is not that smaller firms must be doing the same thing. The evidence cannot support that universal claim. The reasonable inference is that the same technologies and dependencies are distributed across a much larger population with, on average, fewer resources available to detect, investigate, disclose, and survive failure.
That is the 99.7 percent problem. The number is not a vulnerability score. It is the scale at which weak control can remain commercially ordinary and publicly invisible until one failure crosses enough organizational boundaries to become news. Police reports count known ransomware cases. Surveys capture what respondents recognized and chose to report. Corporate notices describe incidents that reached the stage of formal disclosure. None reveals the full population of undetected access, quietly restored systems, unreported extortion, compromised suppliers, unusable backups, or businesses that never learned exactly what happened.
Part 1 argued that “a cyberattack” is not an explanation. Part 2 adds that a headline is not a denominator. The organizations in public breach notices are the observable edge of a system whose risk is distributed through millions of smaller firms and the providers connecting them. The next question is not whether every SME can buy more security technology. It is what functional control looks like when money, people, and authority are limited: which capabilities must exist, what evidence should customers and governments demand, how recovery should be proved, and who remains accountable when the work has been outsourced. That is the subject of Part 3.
For a small business, the technology risk self-check is a ten-minute starting point. My external exposure check is the next step for a small budget: a fixed ¥100,000 + tax review of up to three domains, using only what an outsider can see. A Diagnostics review goes further and maps the dependencies your business actually runs on.