# Japan active cyber defense and infrastructure protection > Live situation record from CLSTR: https://clstr.news/situations/japan-active-cyber-defense-implementation > Updated: 2026-10-23T07:19:36.000Z. Sources: 27. Developments: 7. Japan has initiated a new era of ‘active cyber defense’ following the implementation of the ‘Cybersecurity Capability Enhancement Act’ on October 1. This legislative framework authorizes the police and the Ministry of Defense to perform ‘neutralization measures,’ such as remotely accessing and altering settings on servers used by malicious actors to prevent attacks before they cause damage. Building on this legal foundation, the Japanese government announced plans for fiscal 2027 to enhance threat hunting capabilities specifically for critical infrastructure, including power and telecommunications. On October 12, the government declared a cybersecurity emergency following a wave of significant data breaches and ransomware attacks affecting the finance, transport, and retail sectors. More than 20 large companies have reported incidents, with the total number of recorded attacks in 2026 already exceeding the previous year’s total. Notable breaches include a ransomware attack on IDC Frontier, a SoftBank-linked cloud provider, which impacted 495 organizations, and unauthorized access at Times Mobility involving approximately 6.6 million accounts. JR East also reported the potential leak of 1.67 million customer email addresses, while Dai-ichi Life Group reported a potential leak of personal information for approximately 120,000 employees. Specific details regarding the SoftBank Group’s ‘IDCF Cloud’ breach emerged on October 19, noting that the ransomware attack occurred on October 7. This event has coincided with a broader trend of unauthorized access and information leakage, prompting warnings from various institutions regarding the necessity of immediate security audits and improved log utilization. In response to attackers increasingly using artificial intelligence to search for system weaknesses, Economy Minister Ryosei Akazawa announced that Japan will establish a specialized team under the Information-technology Promotion Agency (IPA) to conduct AI-driven cyberattack simulations. ## Claims - Personal information of approximately 120,000 current and former employees of Dai-ichi Life Group and Dai-ichi Life Insurance may have been leaked. (disputed) - No unauthorized access to customer information has been confirmed in the Dai-ichi Life Group incident. (disputed) - Experts suggest that artificial intelligence is being used to make cyber attacks more efficient and easier to execute. (corroborated by 5 sources) - The Japanese government declared a cyber security emergency following a series of major attacks. (corroborated by 4 sources) - Times Mobility confirmed that data associated with approximately 6.6 million accounts was accessed without authorization. (corroborated by 3 sources) - The National Institute of Information and Communications Technology (NICT) identified App-to-Backend (A2B) attacks, which exploit Android apps to target servers, as a cause of recent leaks. (corroborated by 3 sources) - More than 20 large companies in Japan have been targeted by cyber attacks. (corroborated by 2 sources) - Japan's Cyber Security Minister, Toshiharu Furukawa, described the cyber attack situation as critical. (corroborated by 2 sources) - The Japanese National Police Agency issued a warning regarding information leaks and urged companies and individuals to review security measures. (corroborated by 2 sources) - The Cabinet Secretariat's National Cyber Security Office issued warnings about unauthorized access and data theft via system vulnerabilities. (corroborated by 2 sources) - A ransomware attack on IDC Frontier, a SoftBank-linked company, affected 495 organizations and disrupted cloud services. (corroborated by 2 sources) - Gartner reported that only 30% of large Japanese companies are sufficiently implementing vulnerability management. (corroborated by 2 sources) ## Timeline ### 2026-10-23: Japan to launch AI-driven hacker team to counter cyberattacks Japan is forming an AI-powered expert team to simulate cyberattacks and secure systems following widespread service disruptions caused by PHP vulnerabilities affecting banks, transport, and government agencies. 3 sources. https://clstr.news/cluster/japan-to-launch-ai-driven-hacker-team-to-counter-cyberattacks ### 2026-10-19: IDCF Cloud hit by ransomware attack amid rising cyber incidents in Japan A surge in cyberattacks in Japan, highlighted by a ransomware attack on SoftBank Group’s IDCF Cloud in October 2026, has prompted urgent calls for improved organizational security measures. 3 sources. https://clstr.news/cluster/idcf-cloud-hit-by-ransomware-attack-amid-rising-cyber-incidents-in-japan ### 2026-10-15: Cybersecurity demand rises in Japan amid increasing attack threats Cybersecurity demand is growing in Japan, with IT firms seeing increased sales and police hosting seminars for executives to prepare for rising cyberattack threats. 2 sources. https://clstr.news/cluster/cybersecurity-demand-rises-in-japan-amid-increasing-attack-threats ### 2026-10-12: Japan declares cyberspace emergency amid wave of cyberattacks Japan has declared a cyberspace emergency following a massive wave of cyberattacks affecting hundreds of organizations and millions of users, including major leaks of identity documents and employee data. 15 sources. https://clstr.news/cluster/japan-declares-cybersecurity-emergency-after-major-corporate-attacks ### 2026-10-07: Japan strengthens cybersecurity response amid surge in unauthorized access Japan is ramping up cybersecurity defenses following a surge in unauthorized access and AI-driven attacks. The government is centralizing incident reporting while private firms launch emergency support services 2 sources. https://clstr.news/cluster/japan-strengthens-cybersecurity-response-amid-surge-in-unauthorized-access ### 2026-10-04: Japan to enhance threat hunting for critical infrastructure Japan will launch a fiscal 2027 initiative to bolster threat hunting for critical infrastructure, using virtual simulations and Defense Ministry personnel to detect hidden cyber attackers. 3 sources. https://clstr.news/cluster/japan-to-enhance-threat-hunting-for-critical-infrastructure ### 2026-09-30: Japan implements active cyber defense measures Japan has launched ‘active cyber defense’ operations following the implementation of new cybersecurity laws, allowing authorities to preemptively neutralize cyberattacks on critical infrastructure. 3 sources. https://clstr.news/cluster/japan-implements-active-cyber-defense-measures --- Cite as: Japan active cyber defense and infrastructure protection. CLSTR, https://clstr.news/situations/japan-active-cyber-defense-implementation