Supplier Risk Is Now the Board's Question: What Japan's October Cyber Wave Means for Security Leaders

What Japan's October cyber wave shows, and five questions leadership should be able to answer this week.

In early October 2026, a run of data leaks caused by unauthorised access drew an unusually direct response from the Japanese government. On 8 October, the government convened an inter-ministerial meeting. Shunji Furukawa, the minister in charge of cyber security, said companies would be asked to fix system vulnerabilities, strengthen authentication and prevent the misuse of leaked information, and that these measures should extend to outsourced contractors.

The next day, the Cabinet Secretariat's National Cybersecurity Office (NCO) published an official notice, 「不正アクセスによる漏えい等の事案を踏まえた対応について」 (roughly, Response to incidents of leaks caused by unauthorised access; the notice is published in Japanese only). It confirms multiple cases in which attackers broke into the systems of organisations holding large volumes of personal data and stole it. The NCO names three routes: exploited web-system vulnerabilities, compromise through the supply chain, and weak data management. The same day, at a meeting of the Liberal Democratic Party's National Cybersecurity Strategy Headquarters, its head Masaaki Taira said cybersecurity had entered a new phase and that the country now faced "a state of emergency, a contingency" (非常事態、有事). That is a political warning, not a legal declaration. It came a week after key provisions of Japan's Active Cyber Defence legislation took effect on 1 October.

What the wave shows

Company disclosures have kept coming. The Japan Times reported on 17 October that one company had confirmed 5.31 million sets of personal information were compromised, and that another said about 1.83 million records were exposed after unauthorised access to a cloud service it used for system development. Earlier disclosures reported by Jiji Press show the same pattern: a ransomware attack on a cloud services provider put about 6.09 million customer accounts at one of its clients at risk, and another company said data on about 8.72 million customers may have been compromised through a system managed by an external contractor. Most of these figures are company estimates of records that "may have been" affected, and they may be revised.

The NCO's notice explains the pattern plainly. Attackers sometimes enter through a contractor with relatively weak defences, then extend their access to the real target. The NCO's answer is a change in mindset: manage security "together with your contractors", across the whole supply chain rather than only your own systems.

The notice ends with a request addressed directly to executives. Cyber damage is "no longer a problem for the IT department alone", and leadership is asked to treat cybersecurity as a management issue, including the investment and staffing needed.

This is not a Japan-only issue. Any enterprise with Japanese subsidiaries, plants, customers or suppliers sits inside the same web of shared services. For financial services, pharma, semiconductor and manufacturing groups, that web is usually wide.

Five questions leadership should be able to answer this week

Each of these maps to a point in the NCO's notice. None needs a new programme, but each needs a clear answer, and in many organisations those answers are scattered across procurement, IT and the SOC.

1. Which suppliers can access our environment, and how? The NCO asks organisations to identify critical business partners and contractors, including subcontractors, and to manage the access rights they are given. In practice that means remote support accounts, VPN connections, API keys, shared mailboxes and file transfer services. If the list exists, when was it last checked against what is actually connected?

2. Are supplier-linked accounts and credentials under control? The notice calls for multi-factor authentication, minimal administrator rights, prompt disabling of unused accounts, and never storing passwords or credentials in plain text. Shared and service accounts linked to suppliers are where these basics most often slip.

3. Can we see supplier-related activity separately from everything else? The NCO recommends reviewing access logs now for signs of suspicious traffic or bulk access, and monitoring abnormal authentication attempts and large data retrievals. Most SOCs can say how many alerts they received yesterday. Fewer can say which involved a supplier's account, IP range or domain.

4. If a contractor is breached, will we hear about it, and how fast can we act? The notice recommends contracts that require contractors to report unauthorised access or leaks, and an agreed way of working together during an incident. Then you need to know which of your systems and data depend on that contractor, and be able to search your own logs quickly.

5. What evidence could we hand to auditors, regulators or the board today? With the government asking executives to own this as a management issue, expect questions about which controls are in place and how they are monitored. A dated report that maps what you monitor to recognised frameworks is far stronger than "we are looking into it."

Where an AI triage layer helps, and where it doesn't

It is worth being clear about limits. When a third-party provider is compromised, no alert-triage tool inside your own environment prevents that breach. Contracts, audits and access design are where you influence a supplier's security.

What a triage layer can change is how quickly your team sees supplier-related activity in your own environment, and how well you can show what you did about it. This is the job of SIEM+, Eventus's AI alert triage layer, and it lines up closely with the NCO's call for log monitoring and analysis.

SIEM+ sits on top of an existing SIEM. It does not replace it. Microsoft Sentinel integration is live today, and SIEM+ also works with Devo. In practice it helps in four ways:

• Less noise, clearer priorities. SIEM+ deduplicates alerts into ranked incidents, so analysts work from a short, ordered list instead of a raw queue.
• Supplier context you define. Known-safe and known-bad lists let you mark supplier IP ranges, domains and accounts, so activity involving them stands out instead of blending in. Threat-intelligence checks on IPs and domains add outside context.
• Faster understanding. Each incident gets a plain-English threat summary and remediation guidance for analyst review. Your team still makes the decision; it just starts from a clearer picture.
• Evidence ready for review. Incidents and controls are mapped to NIST CSF and CIS controls, and executive and auditor reports can be exported, giving you something concrete for question five.

For teams without a SIEM, SIEM+ Complete pairs the triage layer with Devo. For teams that want help operating it, Platform + Managed Services adds Eventus analysts. Platform Only starts at USD 300 per month, covering up to 100 users, 40,000 alerts a day and one SIEM source, on a 12-month term billed annually. SIEM+ is in production today with a manufacturing customer in Taiwan.

The board's question

Japan's October wave will be investigated for months, and the reported numbers may change. The government's own guidance already makes the lesson clear: supplier risk is not a procurement checkbox, and security is not the IT department's problem alone. Boards will ask, and security leaders should be ready to answer with facts, not reassurance.

If you'd like to see how SIEM+ handles supplier-related alerts and audit-ready reporting on top of your existing Microsoft Sentinel or Devo environment, book a 15-minute demo at siem.plus.

Sources: National Cybersecurity Office, Cabinet Secretariat, 9 October 2026 (Japanese); Liberal Democratic Party, 14 October 2026 (Japanese); Kyodo News via Tokyo Shimbun, 8 October 2026; ITmedia Business Online, 9 October 2026; The Japan Times, 17 October 2026; Jiji Press via Nippon.com, 9 October 2026. Breach figures are company disclosures as reported by media and may be revised.