Part 5 of a series on Japan’s cybersecurity blind spot. Start with the overview, Japan cyberattacks in 2026: what the breach wave reveals, or read Part 1, Part 2, Part 3, and Part 4.

A senior executive once told me, very firmly, that a website is a digital meishi. A business card. You design it once, print it, hand it out, and forget about it. I’ve heard versions of that idea for fourteen years, and I’ve never heard it said more confidently than by people who had no idea what was running behind their own sites.

This month showed what sits behind the card. Look at where the confirmed entry points in Japan’s breach wave actually were, and a pattern shows up quickly. Most of the companies in the headlines were not breached directly. Someone they hired was.

Follow the vendors

Scala Communications, a Tokyo software company, runs a FAQ and enquiry system called i-ask. Between the night of 2 October and the next morning, someone logged in to its admin site, planted a program on a shared server, and pulled enquiry data stored there for up to five client companies: up to 713,126 enquiries in total. Those five turned out to be Daiwa Securities, Citizen Watch, Sompo Japan, Tobu Railway, and ORIX Life. Daiwa put its exposure at about 110,000 customers. ORIX Life’s included medical details that customers had typed into an enquiry form. Tobu says it has found no sign its data was touched. Four of those five sit inside, or under, Nikkei 225 companies.

On 7 October, ransomware hit IDCF Cloud, run by IDC Frontier, a SoftBank data-center subsidiary, and 495 companies and local governments found themselves inside the impact zone. IDC Frontier told customers that data in the affected zones would be hard to recover and that they could only restore from backups they held themselves. Then the downstream notices arrived. JR East, the East Japan Railway Company, said up to about 2.06 million Ekinet and Otona no Kyujitsu Club records may have been exposed through an email service hosted there, about 6.09 million counting its card arm, View Card. JR Kyushu said about 1.3 million. On 13 October, JR Central added about 15,000 customers of its two online shops. All three major JR companies were hit through one cloud provider, and none of them was breached directly.

Also on 13 October, Arcadia, which sends disaster and crime alerts for local governments through a service called SpeeCAN RAIDEN, put its possible exposure at up to about 3.14 million email addresses. Yokosuka, Minamiboso, Shimonoseki, and others suspended their alert services. One vendor’s breach switched off public safety messages in several cities.

The list keeps going. Asahi Kasei Therapeutics, the Asahi Kasei group’s pharmaceutical company, says data on up to about 514,000 healthcare professionals was exposed through the company that ran its information site for doctors. Daiichikosho, which runs the Big Echo karaoke chain, says a single malware-infected PC at a contractor held data on about 8.72 million customers and employees. Rakuten Drive, Rakuten’s cloud storage service, lost files from 15,382 accounts after someone got hold of an administrator’s credentials.

By my count, at least twelve Nikkei 225 companies, directly or through subsidiaries, disclosed incidents in the first two weeks of October. Most of them came in sideways. Nobody has shown that any of these incidents are connected, and the Chief Cabinet Secretary said as much on 7 October. Where the route is known, though, it keeps running through someone else’s system.

The app is a map

On 13 October, NICT, Japan’s national information and communications research institute, named one cause of the wave. It calls it an A2B attack, for app to backend. Attackers download a company’s public Android app, take it apart, find the servers and APIs it talks to, and attack those. NICT says the same applies to iPhone apps and web APIs, and that AI is making the analysis faster.

That is the digital meishi idea turned inside out. The executive sees a card. The attacker sees a published map of the company’s systems, handed out free to anyone who installs it. The same goes for the website, the enquiry form, the email service, and the domain. None of these are cards. They’re live systems with accounts, databases, and people on the other end, and most of them were built by somebody other than the company whose name is on them.

Control without responsibility

Here’s what I see from the vendor side. Most of the Japanese companies I’ve worked with are proud of how cheaply they’ve outsourced, often to teams in far-off time zones. Some use local developers but still don’t really know what’s being built. And almost all of them want very tight control over what gets developed, which would be fine if they understood it. Mostly they don’t. Leadership treats technology like a one-dimensional palette to paint on: drag and drop, no structure, no databases, no hierarchy, no review. So the requests come in bizarre and hacked together, and they come in as demands.

I recently spent two hours editing an invoice by hand, with command-line code and an API, because the client wanted a layout that the payment system simply doesn’t produce. The invoice was correct and perfectly legal. At one point he wanted to wrap the invoice inside another invoice. That’s a minor case, but it’s the whole pattern in miniature. The builder gets two choices. You deliver something malformed because that’s what was asked for, or you do what the system reasonably requires and get blamed for not being talented enough.

Neither choice puts responsibility where it belongs. The client keeps control and gives away the accountability. The vendor gets the work and none of the authority to do it properly. When something breaks, everybody points at somebody else.

The law already settled this

Who’s to blame when a vendor gets breached? My view is simple. The company is responsible for overseeing its vendors. If shoddy or exploitative work was done on its watch, that’s on the company.

Japanese law agrees. Article 25 of the Act on the Protection of Personal Information requires a business that hands personal data to a contractor to carry out “necessary and appropriate supervision” of that contractor. The Personal Information Protection Commission’s guidelines break that into three parts: choose the contractor properly, put the protections in the contract, and keep checking how the data is actually handled. Outsourcing the work does not outsource the duty. Plenty of companies act as if it does.

Bigger is not safer

There’s a stubborn belief in Japanese procurement that the bigger the team and the longer the chain of command, the better, more efficient, and more trustworthy the result. That is exactly backwards. Every layer between the person who decides and the person who builds dilutes responsibility and slows the fix. i-ask held five companies’ customer enquiries on one shared server. IDCF Cloud carried 495 customers in one region. Those setups looked established and safe. What they actually offered was concentration, and distance from anyone who answered for the outcome.

When I tell company presidents to look for a vendor that’s local, multilingual, experienced, actually present, and small enough to know their system, it’s not because small firms can’t be breached. They can. It’s because with a small operation there’s a named person who owns the work and can move fast when it matters.

Here’s what that looks like. I look after one client’s email and domain, and our agreement gives me authority to act on their systems. During this wave of attacks, I added DKIM, a signature that proves their email really comes from them, without stopping to schedule a meeting first. Waiting to walk someone through it calmly, when they don’t follow the technology, could easily have been too late. I told them afterward, and they were glad I had. That’s the job. You don’t wait for a client to understand a threat before you protect them from it. It’s now part of how I work with every client: low-risk protective changes during an active threat, reported within 24 hours.

Nobody owned the domain

The smallest version of this story is one I lived. A business owner’s domain lapsed, and I watched it get taken over in real time by Cyrillic-language adult websites. When I dug into it, the domain turned out to be registered with a shady crypto registrar a friend had recommended years earlier. He couldn’t remember which one. I got the domain back. He shrugged it off, and he still didn’t hire me to look after it. A critical piece of his business was held by a company he couldn’t name, chosen on a friend’s tip, and owned by nobody.

That’s the vendor problem at the scale of one person. The big companies in this month’s headlines have the same problem with more zeros.

What to check this week

You don’t need a big budget to take responsibility back. You need a list and some honest answers.

List every outside company that holds your customers’ data or runs a system with your name on it: the website, the enquiry form, the app, email delivery, booking, payments, and hosting.
Check whose name the important accounts are in. Your registrar, DNS, email, cloud, and admin logins should belong to your company, not to a vendor or a former employee.
Ask each vendor who can reach your data, whether admin logins require more than a password, and what they’ll do, and how fast they’ll tell you, if they’re breached.
Hold your own backups somewhere other than your provider, and restore one to prove it works.
If you publish an app, assume someone has already taken it apart, and have whoever built it check what its backend reveals.
Write down who’s allowed to act in an emergency, so the right change doesn’t wait for a meeting.

None of this is new technology. It’s ordinary ownership that got handed away along with the work.

If you’re not sure what your company shows the outside world, that’s where I start. My external exposure check reviews up to three of your domains using only public information, the same view any customer, partner, or stranger already has, with no testing of your systems. You get a written report on what to fix first within five business days, plus a 30-minute debrief, for ¥100,000 + tax. The vendor list above is where a Diagnostics review goes next.

The next part, Sovereign AI, made elsewhere, looks at what happened when the government itself needed help.

You outsourced the work, not the responsibility