Japan Declares a Cyber Emergency as More Than 20 Major Companies, From JR East to Lawson, Report Attacks

Japan's government now has a name for the breach notices piling up across the country: an emergency. It said so on Friday, after more than 20 major companies, from convenience store giant Lawson to car-sharing service Times Car, reported attacks that may have leaked tens of millions of pieces of customer data.

At an emergency meeting of the National Cybersecurity Strategy Headquarters convened by the ruling Liberal Democratic Party, cybersecurity minister Toshiharu Furukawa called the situation "extremely critical." NCSH head Masaaki Taira went further, describing an "emergency in cyberspace," according to the Financial Times.

Breaches landing faster than anyone can count

The notices keep coming. Times Car operator Park24 detected unauthorized access on September 25. Data on about 6.6 million accounts was taken, and about 1.6 million of them had identity document images leak, such as driver's license photos. No card data was involved.

Lawson said on October 8 that its Lawson ID service was accessed from September 12 to 14, exposing 2,155,345 records with emails and names. A day later, secondhand retailer Bookoff said up to about 6.43 million member records were taken, and skyticket operator Adventure said about 14.64 million records leaked or may have leaked across three incidents. Daiichikosho, which runs the Big Echo karaoke chain, says about 8.72 million records may have leaked through malware at a contractor, though a leak is not confirmed.

Those figures count records and accounts, not people. These are separate incidents with different causes, and nobody has shown they are linked. Apart from a single skyticket account login, none of the companies reports misuse of the data so far.

One cloud, hundreds of victims

One of the widest blasts came from a cloud provider. Ransomware hit IDC Frontier, a SoftBank cloud subsidiary, starting around 3:40 a.m. Japan time on October 7. It stopped virtual servers in four zones of its East Japan Region 1 that could not be restarted, affecting 495 companies and local governments.

Data in those zones may be hard to recover, and some customers may have to rely on their own backups. IDC Frontier set up an emergency headquarters with SoftBank and reported the attack to regulators and police, but has not disclosed who did it or how they got in.

Two of Japan's railways were caught in it. JR East said Friday that about 6.09 million customer accounts may have been compromised, and JR Kyushu put its figure at about 1.3 million, both from the IDC Frontier attack.

License photos force banks to change

The fallout is already reaching the financial system. After driver's license images leaked from Times Car, the Financial Services Agency told lenders to accept only ID with chips, such as passports or MyNumber cards, when verifying customers.

The broader numbers point the same way. Japan recorded more cyber incidents in the first nine months of 2026 than in all of last year, according to TrendAI data shared with Reuters. And the country knows how bad a single hit can get: in October 2025, an attack on Asahi Group shut most of its 30 domestic factories and left stores short of Asahi Super Dry.

Is AI changing the math?

None of these attacks has been explicitly linked to AI. But Masaki Hiraoka of Blackpanda notes that AI cuts the time-consuming reconnaissance that attacks used to require. "Smaller services that previously weren't worth the effort could become viable targets," he said.

Nobuo Miwa, president of Tokyo firm S&J Corp, told Reuters the wave looked like "carpet bombing" and suggested AI may help foreign hackers get past the language barrier that long gave Japanese firms some cover. It is a pattern already showing up elsewhere in the region, where AI tools are lowering the cost of attacking Korean banks and other institutions that once seemed out of reach.

For now, Japan's companies are still counting what they lost, and the government has admitted out loud that it is an emergency.

Some offers on this page may be paid placements or contain affiliate links.