Japan’s Reported Attack Wave Meets a Defence Build-Out Still in Progress
Japan’s cyber-defence programme is being tested by a reported wave of attacks that the record describes but does not measure. Bloomberg reported in late October that Japan faces an intense wave of AI-powered cyberattacks and that dozens of incidents affecting companies from brokerages to delivery firms have made data leaks routine. Those are Bloomberg’s characterisations, not a verified count.
The same excerpt says the government said an official website for electricity and gas trading information had been breached. It also says hackers claimed days earlier to have published sensitive customer data from GMO Internet Group’s currency trading platform. The GMO claim is unauthenticated, and the excerpt gives no calendar date for the government statement.
A policy stack, documented in stages
The policy response is documented more fully than the incidents that prompted it. A Digital Agency transcript records that on 23 December 2025 the cabinet decided a new Cybersecurity Strategy and a Basic Policy under the Act on Strengthening Cyber Response Capabilities. The strategy set a goal of world-class resilience and put more emphasis on active state involvement, with the state taking the lead because public, private or single-country action alone could not cope.
The Basic Policy was built under the law enacted in May 2025 and covered stronger public-private cooperation and use of communications information. The minister named a public-private council, infrastructure protection guidelines and a system to protect small and medium-sized enterprises as first priorities, describing smaller firms as a weak point. The transcript does not confirm that the council or guidelines were completed.
It also records a plan to establish a Cyber Communications Information Oversight Committee on 1 April 2026, with one chair and four members. The committee was intended to review and approve government use of communications information and access and neutralisation measures. Its later status is not established.
Continuity into 2026
Policy activity continued. According to a summary of a Cabinet Secretariat release dated 31 July 2026, the sixth Cybersecurity Strategy Headquarters meeting decided Cybersecurity 2026, unified critical infrastructure standards, a Basic Policy on Threat Hunting and a budget prioritisation policy. It also received a progress report on Project YATA-Shield, a package formulated in May 2026 to strengthen Japan’s response to attacks that abuse AI. The summary is not proof the measures work.
A white hacker team and a PHP alert
The most specific planned measure is a white hacker team. Digital Today, citing ITmedia, reported that minister Ryosei Akazawa said after a 23 October cabinet meeting that it would launch in November at the Information-technology Promotion Agency under his ministry and others. Its core would be AI-based simulated hacking and penetration testing to find and fix vulnerabilities before exploitation. The report said the team’s staffing, budget and scope had not been disclosed. It describes a plan, not confirmation that the team was operating.
Akazawa also raised the possibility that hackers are using AI to search broadly for vulnerabilities, and argued that defenders need high-performance AI to act before them. That is a possibility, not a finding about the reported incidents. The material does not establish AI as the cause.
Digital Today also described a maintenance alert. On 22 October, the economy ministry and the National Cybersecurity Strategy Headquarters sent an alert to about 1,000 industry groups about a critical PHP vulnerability that could lead to remote code execution. The Information-technology Promotion Agency recommended applying related security updates quickly. The summary gave no CVE identifier, affected or fixed versions, severity score or evidence of exploitation. It should not be read as a warning about all PHP deployments.
The report also described plans to expand a cybersecurity support programme for small and medium-sized enterprises and to introduce a supply chain security measures evaluation system from March 2027. Their implementation is unresolved.
Where the explanations come from
The official record explains what Japan is trying to build, not why the reported attacks are succeeding. Attributed commentary offers explanations, but they are perspectives rather than audits. In JAPAN Forward, NTT chief cybersecurity strategist Mihoko Matsubara cited the July 2023 Port of Nagoya ransomware attack and autumn 2025 attacks on Asahi Group Holdings and Askul Corporation as evidence that one criminal operation can paralyse supply chains and that recovery can take months. They do not establish the incidents’ scale or cause.
Masayoshi Someya of Palo Alto Networks argued there that separate tools adopted by different divisions, offices, group companies or overseas subsidiaries create a patchwork that is harder to manage and monitor. He warned that manual handling of large volumes of alerts contributes to burnout, missed warning signs and experienced staff leaving after two or three years. That is an attributed vendor critique, not an independent assessment.
Takayuki Sugiura of the Japan Hacker Association said intrusion methods are mostly the same, citing VPN access, stolen login details and phishing. He warned that companies become especially vulnerable when they postpone updates to essential systems. That describes common entry points at a general level. It does not identify the route into any reported incident.
Oversight is part of the test
Active cyber defence also raises questions that a white hacker team does not answer. The oversight committee was meant to review use of communications information and access and neutralisation measures. When the bill was before parliament, Nikkei Cross Tech reported that Keio University professor Toru Tsuchiya welcomed it as an important first step but said it would fall well short of the goal of capability equal to or better than major Western countries. He criticised proposed limits on communications-information use and said private-sector cooperation needs incentives because companies decide whether to consent.
Oversight remains unresolved: the record contains plans but not operating evidence. The committee was projected for 1 April 2026, but its status is not established. Project YATA-Shield was reported in July, but the summary does not show what it has delivered. The white hacker team’s November target is close, but its staffing, budget and scope were undisclosed. These gaps do not mean the measures have failed. They mean the record supports a build-out in progress, not a proven defence.
What the evidence can support
The clearest distinction is between official policy, attributed reporting and unverified assertions. Official policy includes the strategy, Basic Policy and planned bodies in government material. Attributed reporting includes Bloomberg’s account of the wave and reported electricity and gas trading website breach, plus Digital Today’s account of the white hacker team and the PHP alert. Unverified assertions include the GMO data publication, the scale of the wave, the role of AI and any named-actor link.
The next useful markers are public confirmation of the team’s launch and remit, evidence that the oversight committee is operating, and technical details for the PHP alert. Until then, Japan’s test is as much about implementation and disclosure as about attack numbers in a headline.
A maintenance alert without a CVE identifier, affected versions or any evidence of exploitation nevertheless put a critical PHP vulnerability in front of about 1,000 industry groups, and deciding what it can reasonably support is a skill in itself. Internet vulnerabilities as a subject covers how a web flaw is scoped, why version ranges and severity scores carry the weight they do, and where a general alert stops short of a specific finding. The same grounding in cybersecurity fundamentals helps you keep official policy, attributed reporting and unverified assertion in separate piles when an incident is described but not measured. The Hack Academy’s online cybersecurity training programme covers both subjects, with self-paced learning and practical exercises alongside the theory.