Japan Declares Cyber Emergency After Wave of Breaches
In short: On October 9, 2026, Japan effectively declared a cyberspace emergency: the head of the country's national cybersecurity task force described the situation as "a state of emergency in cyber space" after more than 20 major companies — from convenience store chain Lawson and car-rental operator Times Car to rail giant JR East — reported attacks and breaches affecting tens of millions of customer records. Times Car alone confirmed roughly 6.6 million compromised accounts, including scanned driver's license photos that, according to Japan's Financial Services Agency, are already being resold on the dark web for about 25 yen each. Japan has logged more than 500 cyber incidents since the start of 2026 — already more than all of 2025.
What happened
The wave built up over several weeks. Times Car, one of the country's largest car-sharing services, confirmed a breach of its database containing digital copies of customers' driver's licenses — a document widely used in Japan for identity verification during online sign-up. Rail operator JR East reported a leak of 1.67 million email addresses from its booking system. Retail chain Lawson, financial group Daiwa Securities, and telecom giant SoftBank Corp also confirmed incidents with possible customer data exposure. Investigations are ongoing at several companies, so the final numbers may grow.
Why officials are calling it an "emergency"
Members of Japan's ruling party held an emergency meeting over the rising number of incidents, and the head of the national cybersecurity headquarters publicly described the situation as a "state of emergency in cyber space." This isn't a formal legal emergency declaration like for a natural disaster, but in tone and urgency it's an unusual step for a country that typically downplays cyber incidents in public statements.
What's driving the surge
Experts point to three main drivers: exploitation of known software vulnerabilities that companies haven't patched in time, stolen employee and partner credentials, and a rise in attacks through contractors and third-party vendors — where attackers breach a less-protected supplier instead of the company itself. Experts also highlight the growing role of AI, which lowers the cost of preparing an attack and lets attackers automatically scan for vulnerable systems across far more companies at once.
What this means if you're a customer
If you've used services similar to Times Car or JR East — car-sharing, online booking, anything that asks you to upload a scanned ID — assume some of your data may already be in the wrong hands. A driver's license photo is especially risky: unlike a password, it can't simply be "changed," and it keeps being usable for identity verification on loans and other financial products. You can check whether your own email and passwords have already surfaced in known breaches using the guide on checking for a personal data leak.
How to lower your risk
- Change passwords on any service where you reused the same email/password combination as on an affected platform — password reuse is what turns one breach into a chain of account takeovers.
- Turn on two-factor authentication everywhere it's available, especially for financial services and email.
- Be cautious of emails or texts asking you to "confirm" a booking, account, or payment — breaches like this are reliably followed by a spike in phishing messages that use real names and dates pulled from the stolen database.
- If a government ID was compromised, check with the issuing authority whether a replacement number or extra verification step is available.
The breaches themselves happened on the companies' side, and no VPN on your end could have prevented that. But while you're entering a login or password on a booking or car-sharing site over café or hotel Wi-Fi, encrypting your traffic with LiMP VPN reduces the risk of that data being intercepted on the network itself as well. For more on protecting accounts in general, see how to protect your account from hacking; plans start at 69 ₽/month — see pricing.