Supplier Risk Is Now the Board's Question: What Japan's October Cyber Wave Means for Security Leaders
What Japan's October cyber wave shows, and five questions leadership should be able to answer this week.
In early October 2026, a run of data leaks caused by unauthorised access drew an unusually direct response from the Japanese government. On 8 October, the government convened an inter-ministerial meeting. Shunji Furukawa, the minister in charge of cyber security, said companies would be asked to fix system vulnerabilities, strengthen authentication and prevent the misuse of leaked information, and that these measures should extend to outsourced contractors.
The next day, the Cabinet Secretariat's National Cybersecurity Office (NCO) published an official notice, 「不正アクセスによる漏えい等の事案を踏まえた対応について」 (roughly, Response to incidents of leaks caused by unauthorised access; the notice is published in Japanese only). It confirms multiple cases in which attackers broke into the systems of organisations holding large volumes of personal data and stole it. The NCO names three routes: exploited web-system vulnerabilities, compromise through the supply chain, and weak data management. The same day, at a meeting of the Liberal Democratic Party's National Cybersecurity Strategy Headquarters, its head Masaaki Taira said cybersecurity had entered a new phase and that the country now faced "a state of emergency, a contingency" (非常事態、有事). That is a political warning, not a legal declaration. It came a week after key provisions of Japan's Active Cyber Defence legislation took effect on 1 October.