Japan urges companies to strengthen cybersecurity response

Japan’s government called on companies to strengthen the security of their IT systems and overhaul their response frameworks.[1] It said a cyberattack could pose a risk severe enough to stop business operations.[1] Its requests included treating cybersecurity as a core management issue, expanding investment, and putting specialist staff and incident-response units in place.[1] These are calls for organizational readiness as well as technical safeguards: companies reviewing their plans can consider whether security responsibilities, dedicated expertise and incident response have clear management support.

Recent attacks resembled saturation attacks in which AI automatically repeated assaults at massive scale.[1] The evidence does not specify how many attacks occurred or quantify their frequency. The government said technical measures were needed to detect anomalies and stop damage from spreading after a system breach but before sensitive information leaked.[1] It also asked companies to quickly share relevant information with the National Cyber Office or specialized security agencies when an attack causes damage.[1] The stated goals were to prevent further harm and improve response capabilities.[1] For teams, the combined message is to plan for detection, containment and communication, rather than treating these as separate concerns.

Times Car said about 6.6 million pieces of user personal data were exposed to outside parties in a cyberattack.[1] In a separate report, the company said identity-verification documents had leaked from about 1.6 million accounts.[3] Those documents included driver’s-license images, address-verification documents, student IDs and family-verification documents.[3] Daiwa Securities and FamilyMart also reported data leaks.[1] Japanese security authorities are investigating the perpetrators and methods behind large-scale unauthorized-access cases.[2] The reported figures distinguish data pieces from affected accounts; they should not be treated as the same measure.

Times Car said it had begun emailing members whose identity-verification documents were confirmed leaked.[3] Its third report was dated September 29, 2026, and marked updated October 1, 2026.[3] The company said it would provide more details in about two weeks, after receiving results from an external specialist investigation.[3] It warned customers to be cautious of emails, texts and calls impersonating the company.[3] Times Car said it does not ask customers for passwords or credit-card information by email, text or phone.[3] Customers and support teams can use that stated warning when checking whether a message is genuine.