Cybersecurity Challenges in Japan: Rising Threats and Legal Responses

Japanese Companies Face Increasing Cyberattack Threats

Japanese companies are facing a growing wave of cyberattacks, exposing vulnerabilities in their digital defenses. This surge is attributed to factors like the rise of remote work, increased use of cryptocurrency, and the use of AI by malicious actors.

Rise in Cybercrime

There were 116 reported cases of ransomware attacks in the first half of the year, matching a record last seen in 2022, data from the Tokyo Metropolitan Police Department show.

Recent incidents include:

• Asahi Group Holdings Ltd. was forced to take its distribution system offline after a ransomware attack.
• Retailers relying on Askul Corp. lost access to their e-commerce platforms.
• The Port of Nagoya, one of Japan’s biggest container terminals, was forced to suspend operations in 2023 after a ransomware attack disrupted communication systems.
• Kadokawa Corp. suffered a breach last year that leaked data on more than 250,000 people.

Expert Insights

According to Lauro Burkart, a Singapore-based official with Sygnia Consulting Ltd, Japan has “a lot of lucrative targets”.

Nobuo Miwa, president of S&J Corp, noted that ransomware gangs previously overlooked Japan due to unfamiliarity with crypto payments.

Challenges in Corporate Japan

Tetsutaro Uehara, a member of a government panel on cybersecurity and professor at Ritsumeikan University,states that Japanese companies tend to outsource everything to their system integrators, reducing in-house cybersecurity expertise.

A report by Fastly Inc. indicates that approximately 46% of Japanese companies have appointed a chief information security officer (CISO), compared to the global average of about 70%.

Transparency and Response

In June 2024, a leading Japanese publishing group experienced a ransomware attack that caused a systemwide crash, leading to delays in publication deliveries and bringing the organization’s video streaming service to a halt. The organization held off from disclosing that customer data had been breached for nearly three weeks.

In February 2024, a ransomware attack crippled the ordering system of a regional supermarket chain. Recovery took over two and a half months for the organization to fully restore operations.

In May 2024, a ransomware attack at a prominent printing and digital solutions company initially announced that it had uncovered no proof that personal data had not been compromised, only to have to retract the statement after evidence surfaced suggesting that a breach had occurred.

Issues for Japanese Organizations

Decision-Making

Slow decision-making processes hinder quick responses to cyberattacks. One manufacturer spent two weeks approving the installation of antimalware software but was targeted in an attack during that time.

Cost

Cybersecurity investment is often viewed as an overhead cost rather than a business enabler. One corporation decided that ¥1 billion was too much to pay for cybersecurity, only to suffer an attack that cost it triple that amount.

Rotation

Employee rotation practices limit the development of in-house cybersecurity expertise. Replacing the head of cybersecurity every two years prevents the accumulation of specialized knowledge.

Silence

A culture of hesitancy to disclose information exacerbates crisis situations. One financial institution's slow response to an attack allowed a customer data breach to worsen.