A wave of cyberattacks has wreaked havoc in Japan over the past few weeks, leaving virtually no industry untouched and the government searching for answers about how to bolster its defenses.
The hackers have tampered with servers, taken local government websites offline and gained access to large tranches of consumer data. Masaaki Taira, Japan’s former digital minister who leads a cybersecurity committee within the ruling Liberal Democratic Party, declared on Friday that Japan was in “a state of emergency in cyberspace.”
Experts said that the attackers were most likely motivated by money. After paralyzing operations, they could attempt to extort local governments and companies into paying large ransoms, or sell the stolen information.
“Their actions may result in the suspension or degradation of systems and services that are important to society,” said Katsunari Yoshioka, a professor at Yokohama National University and an expert in systems security.
A study by TrendAI, a cybersecurity software company, found 600 cyberattacks were reported in Japan in the first nine months of 2026, more than the total number in 2025.
In the past two weeks, a public university had to cancel classes for a week after its servers were attacked. A car-sharing service said that more than one million personal documents had been leaked, including headshots on driver’s licenses and home addresses. A ransomware attack on a cloud service operator owned by SoftBank affected almost 500 companies and local governments, including a rail operator and a police headquarters.
Ransomware attacks have caused major problems in recent years well before A.I., but experts said artificial intelligence may have made these attacks easier.
Toshiharu Furukawa, Japan’s minister of digital transformation, said at a news conference on Friday in Tokyo that the cyberattacks were reaching “across all sectors.”
Why Japan?
As the world’s fourth-largest economy that produces many of the world’s robots, cars and electronics, Japan has long been an attractive target for hackers. Even though it was an early adopter of technology, its cybersecurity infrastructure is underdeveloped, according to experts.
A Microsoft report found that, in 2026, Japan was second only to Taiwan as the most frequently affected by cyberthreats in Asia. The International Institute for Strategic Studies, a London think tank, placed Japan in the lowest of three tiers ranking countries on their cyber capabilities in a 2021 assessment. The report noted that Japan’s military had avoided offensive cybersecurity strategies in the past, in part because of the pacifist constitution the country enacted after World War II.
Artificial intelligence has also turbocharged the work of hackers, experts say. Automated systems can now scan websites for vulnerabilities around the world and around the clock.
Takahiro Anno, a technologist and founder of a political party focused on A.I., said while the Japanese language had once hindered international hackers, A.I.-generated translations have made phishing campaigns more persuasive.
“Until recently — specifically up to about five years ago — Japan seemed relatively insulated from ransomware attacks and similar threats” he said in an interview. “It is very clear in emails or on phone calls when someone cannot speak Japanese fluently, so phishing campaigns were not that successful.”
Ko Fujii, a technology expert and the founder of Makaira, a public affairs agency, said the recent wave of cyberattacks was unlikely to be part of a coordinated, state-sponsored geopolitical attack, according to his agency’s preliminary analysis.
“Japan suffered a high volume of breaches simply because its unpatched infrastructure yielded the highest return on investment” for hackers, he said.
It is unclear what threats the hackers had made, and how the companies have responded to any demands. The Japanese police said last week that the Russian ransomware group Qilin had been responsible for attacks on 53 Japanese companies over the past year and that a suspect had been extradited to Germany. It is unclear if Qilin was responsible for some of the recent cyber attacks.
How is the government responding?
The government has issued alerts with updated guidelines on handling personnel information, Mr. Furukawa said, including removing personal data that is no longer needed and requiring two-factor authentication.
The government was still investigating the causes of the attacks, including whether A.I. was used. “Progress in clarifying the details of these incidents has been slow,” he said.
A new cyberdefense law took effect earlier in October that allows the national police and Japan’s military to monitor and even disable foreign servers and infrastructure to protect national security interests. The law also makes it mandatory for companies to report breaches.
Professor Yoshioka, the systems security specialist, who advised the government as it developed the new law, called for international collaboration, as the infrastructure behind the attacks was unlikely to be confined to Japan.
Hans van der Heijden, a Melbourne-based digital forensics specialist at the global risks consultancy firm Control Risks said that while Japan has made significant strides in its cybersecurity infrastructure, the process will take time and investment.
“Some organizations continue to face challenges in patching vulnerabilities, replacing outdated technology, and implementing modern security controls,” Mr. van der Heijden wrote in an email.
In the meantime, the cyberthreats will continue, he said.
Javier C. Hernández contributed reporting from Tokyo.
The post Ransomware Attacks Have Swept Japan. A.I. May Be Making Them Easier. appeared first on New York Times.
