Security Guides

#incident response #organizations #access control #supply chain #data breach

Japan's October 2026 warnings on unauthorized access (National Cybersecurity Office, IPA, JPCERT/CC): what to check this week, and what to do if you find something

What Japan's October 2026 warnings from the National Cybersecurity Office, IPA and JPCERT/CC ask you to check this week: app logs, cloud and VPN accounts, and the data you hold.

Published 2026-10-12 Updated 2026-10-12 Last verified 2026-10-12 17 min read

For: people who run systems at a company or organization that handles personal data in Japan, and the leadership they report to. In October 2026, Japanese government bodies and national security organizations issued a series of warnings on unauthorized access. This guide turns them into checks to run on your own systems this week. It is based on public documents from the Cabinet Secretariat's National Cybersecurity Office, IPA (Information-technology Promotion Agency), JPCERT/CC, the Personal Information Protection Commission (PPC), the Financial Services Agency (FSA) and the National Police Agency (NPA), all in Japanese. Attack techniques are not covered.

The takeaway

this week, check logs and accounts across internet-facing apps, external services and the data you hold, and treat anything abnormal as an incident

IPA says the recent attacks have not been tied to a vulnerability in one particular product, and appear to start from compromised internet-facing apps and services or accounts. There is no single patch that closes this, so check your own entry points one by one.

List your internet-facing apps and review their logs for the last month, then three months
In cloud, VPN and other external services, look for many failed sign-ins, unfamiliar source addresses and accounts you don't recognise
Inventory the personal data you hold and delete what you no longer use
If something looks wrong, declare a security incident, preserve logs and bring in specialists
Tell leadership that the government says this is no longer only the IT department's problem

Why these warnings came out now

Since around September 2026, organizations in Japan have disclosed one data breach from unauthorized access after another. IPA says disclosures have come from a wide range of businesses, including financial institutions and telecom providers, and that systems behind online and account services handling large amounts of personal data have been broken into and data including personal information stolen.

The following documents were issued between 7 and 9 October.

Date	Issued by	Document	Main content
7 Oct	Personal Information Protection Commission	Responding to large-scale data leaks (warning)	An early look at revised technical safeguards; deleting personal data that is no longer needed
8 Oct (updated 9 Oct)	JPCERT/CC	Alert on the recent series of unauthorized access incidents at Japanese organizations (JPCERT-AT-2026-0030)	Four attack patterns seen, countermeasures, indicators for investigation (IOCs)
9 Oct	Cabinet Secretariat, National Cybersecurity Office	Responding to data leaks caused by unauthorized access	Three pillars: web systems, supply chain, data management
9 Oct	IPA	Measures to take promptly in light of data leaks caused by unauthorized access	Checks to run now and measures to take (updated as needed)
9 Oct	Financial Services Agency	Strengthening cybersecurity and handling account applications in the current situation	Requests to financial institutions to review controls and tighten identity checks

JPCERT/CC says that while several products and services have been affected, sharing of technical information has been lacking and what is known is limited. None of the documents names individual incidents. Japanese incidents of unauthorized access this site covered in September and October include Times Car, Yamato Transport and Sagawa Express, the Seicomart app, the Yakiniku King app, a Daiwa Securities contractor and Lawson ID. What each company disclosed is in the linked articles.

This week's checks: IPA's three areas

IPA lists three areas under "checks to run promptly". Below they are broken into concrete tasks. Run all of them only on systems you manage.

List your internet-facing apps and review their logs, last month first, then three months

List every app and service you built or operate that can be reached from the internet: member sites, the APIs your mobile apps call, contact forms and admin screens. JPCERT/CC says systems not meant for the general public, such as BI tools and admin systems for employees, have also been hit, so include internal-facing ones.

For each app, check the logs for anything abnormal. IPA's examples are a large volume of errors and patterns that differ from normal. In practice, look for spikes in requests to admin screens or APIs in the web server access log, the same error repeating in the application log, and large retrievals at night or on weekends. Start with the last month, then widen to three months.

IPA also asks you to know who can investigate and how, since you may need to investigate more than once. Finally, check the components of each app and service (for example the OS, middleware, libraries and CMS) for unapplied security fixes and apply them as soon as possible.

In cloud, VPN and other external services, check failed sign-ins, source addresses and unknown accounts

List the cloud services, VPNs and SaaS you use. IPA asks you to include services individual departments signed up for. Ask finance and sales whether they hold contracts the IT team doesn't know about.

In each service's logs, look for many failed sign-ins, unfamiliar source IP addresses and sign-ins at unusual times. IPA notes that retention periods vary by service and that the provider and the customer may see different logs. If the admin console shows only a short period, ask the provider.

For accounts, check whether any were created that you don't recognise, and whether any you disabled or deleted have been re-enabled. IPA says reviewing the audit log of account operations helps. This is the organizational version of checking whether someone accessed your account.

Inventory the personal data you hold and delete what you don't need

IPA notes that stolen data is being used for extortion and resale, and asks organizations to hold only the data they need and to know exactly what they hold. For each database and file store, write down what data it holds, how many records, why, and until when. Anything you can't explain is a candidate for deletion.

The PPC's warning from the same week reminds businesses that Article 22 of Japan's personal information law asks them to make efforts to delete personal data without delay once it is no longer needed, and says it has seen cases made worse because this was not done. Where a law sets a retention period, write down that basis and period too.

IPA also says public bodies and security vendors may publish information useful for investigation, such as suspicious IP addresses, and asks organizations to step up information gathering for now.

Even if the checks come back clean, keep going

IPA asks organizations to consider further measures even if no anomaly is found. For internet-facing apps and external services: review what is exposed, strengthen authentication such as multi-factor authentication and passwords, review account privileges, review how API integrations are managed, and review what is logged and for how long. For data: reconsider whether to keep it, reconsider where it is stored, review access records and their retention, and encrypt it.

The National Cybersecurity Office's three pillars, as concrete checks

The National Cybersecurity Office's notice cites exploitation of web system vulnerabilities, compromise through the supply chain and weak data management as the background, and sets out key measures for each. The right-hand column rewrites the notice's items as questions you can check in your own organization.

Pillar	Main items in the notice	What to check
1. Proper management of web systems	Apply security patches promptly (including internal servers not exposed to the internet), stop using unsupported products, shut down unused systems and functions, run regular vulnerability assessments, disable unneeded ports and services	Can you list each public and internal server with its support end date and last update?
1. (accounts and authentication)	Multi-factor authentication, ban easily guessed passwords, keep admin accounts to the minimum, promptly disable accounts of leavers, movers and unused accounts	Can you name the owner of every admin account? Are any leavers' accounts still active?
1. (resilience)	Collect and keep logs, monitor suspicious traffic and bulk access, detect abnormal authentication attempts from outside, prepare incident response	When bulk retrieval or repeated failed sign-ins happen, who gets notified?
2. Supply chain including contractors	Check contractors' policies, structure and division of responsibility, know the state of subcontractors too, put access control, logging and breach-reporting duties in contracts, give contractors only the data they need, ensure deletion after the work ends	For each contractor, can you fit the personal data you share, the accounts you grant and the incident contact on one page?
3. Proper data management	Know where information is and who manages it, define purpose and retention, inventory regularly, separate read and write permissions, encrypt stored data and traffic, never store credentials in plain text, check cloud exposure and access settings, record access to personal data and watch for bulk retrieval	Can you find out afterwards who accessed personal data and when?

On the supply chain, the notice asks organizations to act on the understanding that they "manage together with contractors", because attackers sometimes use a less-defended contractor as a foothold and then expand access into the target company. Contractor and maintenance accounts are also covered in the security baseline for organizations.

National Cybersecurity Office: what to protect

Web systems / supply chain including contractors / data management

IPA: what to check this week

Internet-facing app logs / external service accounts / the data you hold

JPCERT/CC: what is happening

Four attack patterns / countermeasures / leads for investigation (IOCs, updated)

How the three documents divide the work. The National Cybersecurity Office says what to protect (three pillars), IPA says what to check this week, and JPCERT/CC describes the attacks seen and gives leads for investigation.

The four patterns JPCERT/CC has seen

JPCERT/CC's alert describes attack patterns, separate from ransomware, that lead to large data leaks and appear to be increasing in particular. They are summarised here only far enough to show where to look.

Pattern	Summary of JPCERT/CC's description	Where to check
Case A	Probing for known vulnerabilities and trying to exploit them, including attempts to take configuration or backup files by exploiting poorly managed equipment	Patch level of public servers; whether config files or backups sit in public folders
Case B	Unauthorized requests to an app's admin API leading to data being altered. Reports include identifying APIs by analysing public apps, attacks on internal APIs, and misuse of API keys stolen from other systems	Whether admin and internal APIs require authentication and access control; API key permissions and expiry
Case C	Exploiting a SQL injection vulnerability in Metabase (CVE-2026-72898) through unauthorized API requests	Whether you run Metabase, whether it is patched, whether it is reachable from the internet
Case D (added 9 Oct)	A WAR file (a packaged Java application) placed on an application server reachable from a public web server, with a file inside acting as a simple web shell (a malicious program that lets outsiders run commands)	Whether the application server's management functions are reachable from the public side; whether every deployed app is one you put there

Case C is covered in the Metabase vulnerability breaches and the CVE-2026-72898 explainer. For config files and backups in the wrong place, see did you leave a secret file in a public directory?

For access through APIs, JPCERT/CC recommends per-function rate limits on sign-in, password reset, SMS sending and search; access control including on non-public APIs; minimal permissions and sensible expiry for API users and tokens; and the ability to revoke unneeded or possibly leaked tokens quickly. Its general measures include restricting source regions for services used only in certain areas, updating versions affected by known vulnerabilities, reviewing how to limit lateral movement if a web server is compromised, checking detection and first response, taking unneeded admin functions off the internet, deleting data past its retention period or purpose, and preparing in advance to warn customers against follow-on harm if a leak happens.

For the indicators (IP addresses, User-Agents), use JPCERT/CC's current page

JPCERT/CC's alert lists suspicious source IP addresses and examples of User-Agents seen in the attacks. The list was extended on 9 October and may change again, so this site does not copy it. Check the current list in JPCERT/CC's alert (JPCERT-AT-2026-0030, Japanese) and search your own logs for the same sources. JPCERT/CC says these may have been legitimate use at the time of investigation, so a match alone does not prove an intrusion. Follow what that source actually did in your logs.

If you find something: go in this order

IPA asks organizations to declare a security incident promptly when they find abnormal logs or accounts. Waiting to see what happens can let logs age out before anyone looks at them.

Declare a security incident

Escalate the anomaly to the person in charge the same day and decide to treat it as an incident. A declaration can be withdrawn later; a late start cannot be made earlier.

Preserve logs and evidence

Logs disappear when their retention period ends. Before deleting or overwriting anything, copy server logs, logs you can export from external services' consoles and account audit logs to a separate location. Ask specialists whether to preserve disk images before rebuilding a server. The order of steps is in "What to do first if you find something" in how to check if your website or server was hacked.

Bring in a specialist firm

Given the possibility of data leakage, IPA strongly recommends engaging a specialist security firm for detailed investigation. JPCERT/CC accepts incident response requests. Don't decide on your own how far an attacker got or what was taken.

Report to the PPC and share information

If personal data leaked or may have leaked, a report to the PPC and notice to the people affected may be required. Deadlines and where to report are summarised in how to check if your website or server was hacked. The National Cybersecurity Office asks affected organizations to share technical information promptly with it, the relevant ministry and specialist bodies to prevent further harm. IPA's reporting window and the police cybercrime desks are also available.

1 → 3 months

How far back to review internet-facing app logs (IPA)

Attack patterns JPCERT/CC has seen (cases A to D)

3 pillars

The National Cybersecurity Office's key measures

What to tell leadership

The National Cybersecurity Office's notice says damage from cyberattacks is no longer only the IT department's problem, because a leak can lead to business stoppage, customer handling and other management risks. It asks leadership to treat cybersecurity as a management issue and to strengthen it, including the necessary investment and staffing. IPA likewise asks for an urgent review of measures as a matter of management responsibility.

When reporting upward, keep it to four points so leadership can decide.

This week's results: for each of the three areas, whether you found anomalies, found none, or could not check
What you could not check: periods with no logs, external services or contractors you could not account for
Decisions needed: the cost of longer log retention, a standing arrangement with a specialist firm, requests to contractors
Customer readiness: the notice text and contact point for a leak (JPCERT/CC recommends preparing warnings against follow-on harm in advance)

Some sectors have received requests from their regulator too. The FSA asked financial institutions to review their controls, including third-party risk management and incident response, and to act promptly on any gaps. It also asked them to check ID document images and face images for anything unnatural in online identity verification, and to move to reading IC chips early, ahead of 1 April 2027, when submitting ID document images stops being an accepted method.

This site's view: 'the logs weren't there' is a result, not a failed check

IPA's checks assume you can look back a month, then three months. In practice, teams often find that logs were set to expire after 30 days, or that an external service's console only shows two weeks.

In that case, don't report "no anomalies". The accurate report is "no anomalies in the last month; earlier periods could not be checked". Writing down which periods and systems you could not check tells you the next fixes directly: longer retention, shipping logs elsewhere, asking the provider. This week's check is as much about learning how far back you can see as it is about finding anomalies.

Messages for staff and customers

The NPA, citing the continuing leaks, asks companies to keep internet-connected equipment updated and use strong passwords, and asks individuals not to click links in emails carelessly (they may be fake emails pretending to be the company that leaked data), not to reuse passwords, and to use multi-factor authentication. After an incident, fake messages using your organization's name may increase. Tell staff and customers to verify any contact through your official website. See what is phishing? for how to spot them.

Sources (official, in Japanese)

Cabinet Secretariat, National Cybersecurity Office: Responding to data leaks caused by unauthorized access (9 October 2026) — cyber.go.jp
IPA: Measures to take promptly in light of data leaks caused by unauthorized access (9 October 2026, updated as needed) — ipa.go.jp
JPCERT/CC: Alert on the recent series of unauthorized access incidents at Japanese organizations (JPCERT-AT-2026-0030, published 8 October 2026, updated 9 October) — jpcert.or.jp
Personal Information Protection Commission: Responding to large-scale data leaks (warning) (7 October 2026) — ppc.go.jp
Financial Services Agency: Strengthening cybersecurity and handling account applications in the current situation (9 October 2026) — fsa.go.jp
National Police Agency: Cyber Police Agency Letter 2026 Vol.19 (October 2026) — npa.go.jp
JPCERT/CC: incident response request — jpcert.or.jp
IPA: reporting computer viruses and unauthorized access — ipa.go.jp

Update history

2026-10-12: First published. Documents from the National Cybersecurity Office, IPA, JPCERT/CC, PPC, FSA and NPA checked on 12 October 2026. IPA's page is updated as needed and JPCERT/CC's alert may receive additions; this article will be updated if they change.

FAQ

QWhat is Japan's National Cybersecurity Office asking organizations to do?

Its 9 October 2026 notice, 'Responding to data leaks caused by unauthorized access', asks businesses, especially those handling large amounts of personal or sensitive information, to promptly consider strengthening their measures. It has three pillars: proper management of web systems (vulnerabilities, accounts, logging and monitoring), defending against compromise through the supply chain including contractors, and proper data management (inventory, minimisation, permissions, encryption and access records). It asks leadership to treat cybersecurity as a management issue and to strengthen it, including investment and staffing.

QWhere do IPA's 'urgent measures' start?

IPA lists three checks first: list your internet-facing applications and review their logs; list the external services you use (cloud, VPN and so on) and review their logs and accounts; and re-check the data you hold. Even if the checks find nothing, it asks organizations to consider measures such as stronger authentication, reviewing account privileges, reviewing what is logged and for how long, and encrypting data.

QHow far back should I review logs?

For internet-facing applications, IPA says to widen the review in stages, for example the last month and then three months. For external services, it notes that retention periods differ between services and that the provider and the customer may see different logs. If you only have one month of logs, record that you could not look back three months and treat longer retention as a fix to make.

QDoes this apply to small businesses or companies that hold little personal data?

The National Cybersecurity Office's notice is aimed in particular at businesses handling large amounts of personal or sensitive information. IPA, however, also points small businesses to its SME security guidelines and its five-minute self-assessment. JPCERT/CC says breaches have hit not only consumer-facing apps but also BI tools and internal admin systems for employees, so internal systems belong in the check too.

QIs blocking the IP addresses JPCERT/CC published enough?

No. JPCERT/CC says the source addresses it lists may have been legitimate use at the time of investigation, and the alert has already been updated with more entries. Use the list as a lead for searching your own logs, check JPCERT/CC's page for the current version, and keep reviewing logs, patching and strengthening authentication in parallel.

QWho do I contact if I find signs of unauthorized access?

IPA asks organizations to declare a security incident promptly when they find abnormal logs or accounts, and strongly recommends engaging a specialist security firm for detailed investigation. If personal data leaked or may have leaked, a report to Japan's Personal Information Protection Commission may be required. The National Cybersecurity Office asks affected organizations to share technical information promptly with it, the relevant ministry and specialist bodies. JPCERT/CC's incident response request, IPA's reporting window and the police cybercrime desks are also available.