Under Siege by Record Number of Cyber Attacks, Japan Declares Unprecedented National Emergency

A string of damaging cyber attacks that took place throughout September, topped off by a massive downstream client breach of a leading cloud services provider in early October, has caused the Japanese government to take the never-before-seen step of declaring a national cybersecurity state of emergency.

The reason for the sudden focus on Japan is primarily owed to increased ease of access and opportunity created by new AI tools, combined with rampant vulnerabilities in badly outdated legacy systems throughout the country. The incident serves as a warning that a “security through obscurity” perspective, or being “too small to bother breaching,” is no longer an acceptable position for organizations in the age of persistent AI hacking.

No place to hide from cyber attacks in the AI era

In total, the recent cyber attacks are thought to have exposed at least some personal information for a little over a tenth of Japan’s entire population. The biggest incident, the one that took place in early October, ended up compromising 495 downstream businesses including major national railway providers.

The government has good reason for declaring a cyber emergency. Japan has seen a very active year of cyber attacks thus far, and with 86 incidents logged in September it has already pushed past its previous annual record with three months left to go in the year.

The biggest individual incident to date was disclosed in late September. Leading vehicle rental service Times Car suffered a breach that exposed 6.6 million records of personal information, including driver’s license and other identity images for some victims. The incident caused the national Financial Services Agency to recommend to the nation’s banks that regular driver’s licenses should no longer be considered acceptable as a single source of ID due to the scope of the breach. This is not legally binding, but the agency recommends that banks require an ID with an embedded chip (such as the national health system identification card) instead.

This was paired with a smaller but still significant ransomware attack on Keio Corporation (another railway company) that was disclosed at about the same time. The big attack on IDC Frontier, a widely used cloud services company owned by SoftBank, came on October 8. The damage from this attack is still being fully assessed, but it involved at least 6.09 million records of customer data from the View Card payment system (also owned by a railway company, JR East) being exposed along with another one million email records belonging to the Kyushu Railway Company.

Formerly uniquely strong against cyber attacks, Japan now uniquely vulnerable

It’s no coincidence that Japan is experiencing this wave of cyber attacks, nor that it seems to be disproportionately hitting railway companies (though many other sectors have also been impacted). Japan has had something of a shield from the waves of cyber crime that other countries experience to date. While it is one of the world’s largest economies, phishing and scamming in Japanese is uniquely difficult for non-native speakers. AI’s increasingly excellent translation capabilities are unfortunately shattering that barrier.

That opens up a lot of very traditional, set-in-their-ways companies in the country that have hung onto legacy systems for far too long. Cyber criminals are now taking interest in even small companies in Japan that are poorly defended and that can be sized up by AI probing in a very short time.

The emergency declaration is the national wake-up call, but many organizations will likely need assistance even if the will to change is there. The National Cybersecurity Office has opened this process by issuing guidance for the nation’s local governments and businesses, which includes items specific to emerging AI threats. The start of October also marked the activation of the new Active Cyber Defense (ACD) law allowing for more aggressive pursuit and disabling of malicious infrastructure.

But Masaaki Taira, head of the National Cybersecurity Strategy Headquarters (NCSH), has made clear that this is a large and difficult challenge. The NCSH has indicated that Japanese businesses of all sizes must expect AI-assisted cyber attacks going forward, and that critical infrastructure companies (such as the railway firms that have already been breached) should expect the worst of it.