Japan's METI warns firms after a spate of breaches

What did METI ask companies to do?

METI asked companies to manage security across their whole supply chain, not just inside the company, and named three measures: leadership from the top of the organization, early action on vulnerability information and a move to "zero trust". The document, dated October 9, 2026, came from the Cybersecurity Division of METI's Commerce and Information Policy Bureau.

Here, the supply chain means the contractors, vendors and business partners a company relies on. Zero trust is a security model in which no device or network is trusted by default, even inside the company, and access is checked every time. At a press conference the same day, Minister of Economy, Trade and Industry Ryosei Akazawa described it as constantly checking every action inside internal systems.

The alert goes out through about 1,000 industry groups

Akazawa told reporters on October 9 that the ministry would send the alert that day through about 1,000 industry groups it oversees. He asked the heads of companies to take responsibility for securing the people and budget needed and to lead the response themselves.

Akazawa also recalled that he had personally asked the heads of critical infrastructure operators to act in May, and said METI would keep checking on their progress. He named two kinds of information to protect: people's personal data and information that matters for Japan's economic security.

How companies should report a cyber incident to METI

Companies in industries METI oversees should contact the METI division in charge of their industry promptly when a cyberattack, or a suspected one, causes damage. METI asks for three pieces of information, as far as the company can provide them:

• A timeline from discovery to the present, including when the incident happened and when it was found
• The damage, such as a data leak or a system outage
• The type of attack, such as ransomware, unauthorized access or DDoS

In return, METI says it can introduce specialist organizations and advise on next steps. It will not publish what a company reports without consent, though it may share the information with the National Cybersecurity Office if the company agrees. Companies that become crime victims are also encouraged to report to or consult the police.

The three alerts METI tells companies to read

METI's document asks companies to read three alerts from that week: one from the National Cybersecurity Office (NCO), one from JPCERT/CC and one from the Personal Information Protection Commission (PPC). All three came out between October 7 and 9 and respond to the same run of break-ins.

Government cyber office calls security a management issue

The National Cybersecurity Office, part of the Cabinet Secretariat, said on October 9 that it had confirmed several cases in which attackers broke into the systems of companies holding large amounts of personal data and stole it. It traced the cases to exploited web system vulnerabilities, intrusions through the supply chain and weak data management.

The office grouped its advice into three areas. Each one lists concrete steps, such as applying patches quickly and checking how contractors handle data:

• Proper management of web systems
• Defenses against intrusions through the supply chain
• Proper management of data

It also wrote that cyber damage is no longer a matter for the IT department alone. Executives should treat cybersecurity as a management issue and fund the investment and staffing it needs.

JPCERT/CC lists four attack patterns, including API abuse

JPCERT/CC, Japan's national computer emergency response team, published its alert on October 8 and said leaks of personal data from unauthorized access had piled up at Japanese organizations since around September 2026. An update on October 9 brought the number of attack patterns it describes to four:

• Probing for known software vulnerabilities
• Unauthorized operations through APIs
• Exploiting a SQL injection flaw in the BI tool Metabase (CVE-2026-72898)
• Planting web shells on application servers that can be reached from public web servers

An API is the interface that apps and systems use to exchange data. In the API cases, attackers analyzed public smartphone apps to find API endpoints and keys, then sent requests to internal APIs that the app's own screens never call.

JPCERT/CC recommends capping the number of API requests per unit of time. It also covers access control on every API endpoint, including ones that are not public, and tokens that carry only the permissions they need and expire.

Privacy watchdog urges firms to delete unneeded data

The Personal Information Protection Commission, Japan's privacy regulator, issued its alert on October 7 to businesses that hold large amounts of personal data. It said it had seen cases in which outside attackers leaked, or put at risk, large volumes of such data.

The alert previews technical security measures from a planned revision of the "examples of methods" in the annex to its General Rules guidelines, which is due to be finalized in April 2027. The commission also reminded businesses to delete personal data they no longer need. In some cases, it said, old data that should have been deleted made a leak larger.

Four breaches disclosed from October 6 to 9

In the four days up to and including the day of METI's alert, at least four large breaches were disclosed in Japan. These are the ones SOKUFU has covered so far:

Breaches disclosed October 6–9, 2026 (based on each company's disclosure)

Date	Company	What happened	Records
Oct 6	Scala Communications	Daiwa Securities data breach: 5 firms, one vendor	Up to 713,126 in total
Oct 8	Lawson	Lawson data breach exposes 2.16M Lawson ID users	About 2.16 million
Oct 8	Daiichikosho	Big Echo data breach: 8.72M records may be exposed	About 8.72 million
Oct 9	Adventure Inc. (Skyticket)	Skyticket data breach: 3 incidents, up to 14.64M	About 14.64 million in the largest

Two of the four, Scala Communications and Daiichikosho, came through a vendor or contractor. Both METI's document and the NCO's document mention intrusions through the supply chain in their opening paragraphs.

Supply chain security ratings due to start in March 2027

METI says it is preparing a supply chain security rating system, called the SCS rating system, to start in March 2027. It will rate the security of companies in a supply chain against a common standard. The aim is to raise the level across the whole chain while easing the burden on both the companies that outsource work and their contractors.

The document closes with six support programs that companies can use. Three of them mention small and midsize businesses:

Support programs listed by METI (from METI's document)

Program	What it is
SECURITY ACTION self-declaration	A first step into security
Cybersecurity Otasuketai service	A service to protect your company
Using the SCS rating system	A supply chain measure for small businesses
SME information security guidelines	Security guidance for small businesses
Registered Information Security Specialists	Experts to consult when in trouble
Incident response guide for SMEs	A guide for after an attack