Japan’s cyber emergency declaration after weeks of critical cyberattacks and data breaches is leading experts to consider AI as a reason for the surge.
On October 9th, 2026, Japan declared a state of cyber space emergency in light of significantly increased cyber attacks. The statement came after the recent weeks of cyberattacks on over 20 major companies - attacks that have compromised customer data. Trend Micro, a cybersecurity firm based in Tokyo, discussed the sheer scope of the hacks that Japan has weathered recently with Nikkei Asia. According to their findings, 600 Japanese companies and organizations had already reported cyber incidents and cases of unauthorized access from the start of the year until the end of September. As the summer has only brought more and more cyber incidents, this year’s total number could exceed the highest record of incidents from 2024 (644).
Adding to the alarm, many of the intrusions have been impactful. Times Car, Japanese company Park24’s car rental service, suffered a cyber attack that exposed the identifying information related to 6.6 million accounts, including driving licenses. The breach affected most of the current 4.15 million users while still pulling data from older accounts that had been closed within the last seven years. This hack led to the nation’s Financial Services Agency urging lenders to use identification with ID chips for verification purposes. An attack on GMO Research & AI Inc, resulted in nearly 948,500 members’ names, telephone numbers and other information, with 2.86 million yen in reward points being used by the attackers on Amazon gift cards. An attack on Mr Max Holdings Ltd, a discount store retailer, similarly weathered a data breach that exposed the data (phone numbers and email addresses) of over 1,735,000 registered users.
The attacks have resulted in calls for change. A professor at Yokohama National University and systems security expert, Katsunari Yoshioka, warned that the hacks “may result in the suspension or degradation of systems and services that are important to society”. Toshiharu Furukawa, Japan’s minister for digital transformation said the Trend Micro report was a sign: “Everyone must become vigilant about protecting your own information yourself.” The president of S&J Corp (another Tokyo-based cybersecurity firm) Nobuo Miwa, also weighed in: “The attackers have experienced a breakthrough that has rendered many of the old assumptions obsolete. Our defenses need their own breakthrough as well.”
Any solution to the barrage of cyberattacks will likely have to address the suspected cause of the surge: artificial intelligence (AI). Takahiro Anno, a technologist and founder of Team Mirai - an emerging political party in Japan marked by support for AI use, and the aim of using technology to make government more efficient - connected the wave of attacks to AI lowering the skill requirement to hack Japanese systems: “Until recently — specifically up to about five years ago — Japan seemed relatively insulated from ransomware attacks and similar threats… It is very clear in emails or on phone calls when someone cannot speak Japanese fluently, so phishing campaigns were not that successful.”
This explanation is not new or entirely specific to Japan. The United Kingdom’s National Cyber Security Centre (NCSC) released a report in 2024 that predicted that AI would be a boon for socially engineering threat actors, as it would reduce the rate of translational and grammatical errors that could help a potential victim identify any phishing attempts as fraudulent. The FBI similarly issued a warning about AI being used by cybercriminals in 2024, with FBI Special Agent in Charge Robert Tripp describing the risk: “As technology continues to evolve, so do cybercriminals' tactics. Attackers are leveraging AI to craft highly convincing voice or video messages and emails to enable fraud schemes against individuals and businesses alike. These sophisticated tactics can result in devastating financial losses, reputational damage, and compromise of sensitive data.”
AI’s ability to develop automated workflows has also been linked to the increased number of attacks. Just as the NCSC report predicted that AI “will almost certainly increase the volume and heighten the impact of cyber attacks over the next two years,” cybersecurity experts have said that AI can be used to automate the traditionally-time consuming steps in cybercrime, like searching for vulnerabilities to exploit. Miwa used a strong metaphor to describe the situation: “AI doesn’t get tired… My view is that Japan is essentially being subjected to carpet bombing”.
Some experts aren’t as confident in linking AI to the attacks in Japan - a representative from Trend Micro acknowledged that though AI may be used in preparation of an attack, “finding evidence that it was used in the attack itself remained hard to trace.” Still, the spread of AI into cybercrime spaces has made use of the tool in malware a guarantee, according to chief analyst of the Google Threat Intelligence Group (GTIG), John Hultquist, who spoke on the issue in September: “At this point, we can assume that all threat actors are using AI in some capacity, and their operations have benefited… AI is being applied to several other areas, and it will be especially challenging as it is applied agentically, creating a scaled, faster adversary.”
A solution to this adversary is still in development. President & CEO of SoftBank Corp, Junichi Miyakawa, shared his plans in a company statement responding to increased cyberattacks this June: “Leveraging the practical expertise we've acquired through our use of OpenAI's cybersecurity technologies, we’ll confront the increasingly sophisticated cyber threats targeting Japan's critical infrastructure.” Japan’s National Cybersecurity Office (established in July 2025) shared a warning about the cyberattacks on October 9th, and digital transformation minister Toshiharu Furukawa reportedly met with ministries and agencies the day before, showing a preference for advising the public to watch for potential cyberattacks.
One answer to the problem may have been issued back in May 2025 - with the enactment of Japan’s Active Cyber Defense Law. The act drew some controversy about the change from Japan’s traditional passive stance prioritizing defense over offense, as it permitted the government to infiltrate and defuse hostile servers before attacks occur. More recently, the Active Cyber Defense framework started to mandate cyber incident reporting from designated critical infrastructure operators, with initial notifications from existing systems being due in six months from the requirement start date - October 1st, 2026. With luck, this proactive approach will help Japan exit this state of cyber emergency.