Japan declares cybersecurity emergency as AI-driven attacks hit 1.4 crore citizens

Japan declared a cybersecurity emergency on October 9, 2026, after a surge in AI-driven ransomware attacks and data breaches compromised the personal information of more than 1.4 crore citizens. A single attack on a cloud service provider reportedly affected 495 businesses within hours, highlighting how artificial intelligence is enabling cybercriminals to scale attacks at an unprecedented pace.

The declaration followed a sharp increase in cyber incidents across the country. Japan recorded 86 incidents in September alone, up 37% from July, taking the year-to-date tally beyond 500 for the first time. The total has already surpassed the 473 incidents reported in all of 2025 and approaches the previous annual record of 503, set in 2024.

Japanese officials flag ‘saturation attacks’

Masaaki Taira, the Liberal Democratic Party’s chief artificial intelligence policy official and head of the National Cybersecurity Strategy Headquarters (NCSH), convened an emergency meeting on October 9 to assess the escalating threat.

“When AI takes over part of the process, a small group of hackers can target significantly more systems,” Taira said. He described the emerging threat as “saturation attacks”, in which cybercriminals use AI to automate and scale operations against Japan’s legacy infrastructure. The shift marks a departure from the more targeted, resource-intensive intrusions that characterised cyberattacks over the previous decade.

The growing use of AI in cybercrime is raising concerns about the speed and scale at which attackers can identify vulnerabilities, execute intrusions, and compromise multiple organisations through interconnected systems.

Government directs ministries to strengthen defences

Cybersecurity Minister Toshiharu Furukawa described the overall situation as “extremely critical”, underscoring the urgency of the response.

Following the emergency meeting, Japan’s National Cybersecurity Office, established in July 2025 as a strengthened successor to the former National Information Security Center, issued mandatory security instructions to all government ministries. The directives must also be communicated to local governments and private-sector operators across the country.

The Liberal Democratic Party has called for stronger public-private cooperation to counter large-scale automated intrusions, as concerns grow over the vulnerability of legacy infrastructure and interconnected cloud systems.

The latest developments highlight the growing challenge facing governments and businesses as AI lowers the barriers to executing cyberattacks at scale. With incidents increasingly capable of spreading across multiple organisations within hours, strengthening cybersecurity preparedness has become a critical priority for Japan.