Japan Declares Cyber Emergency as AI-Enabled Attacks Hit Major Firms

Key points

• Japan declared a 'cybersecurity emergency' after over 20 major firms, including Lawson and Times Car, reported attacks.
• JR East lost 1.67 million customer email addresses, while Bookoff Group and JR East confirmed over 6 million records were compromised.
• The Financial Services Agency banned driver's licenses as ID for new accounts after Times Car leaked digital ID images.
• Police detected 13,687 suspicious pre-attack scans per IP address daily in early 2026, a 50% increase from last year.
• Experts like Masaki Hiraoka argue AI lowers barriers for hackers, making smaller targets viable and overcoming language obstacles.

Background

This crisis follows a similar AI-driven banking breach in South Korea in October 2026, where authorities linked attacks to AI tools targeting third-party portals. Japan's current emergency reflects a broader regional trend of AI-enhanced cyber threats, distinct from the 2025 Asahi Group ransomware incident that caused physical supply shortages.

How outlets are covering it

PCMag and Gizmodo emphasize the role of AI in lowering attack barriers, citing experts who note that AI enables hackers to target smaller services and overcome language barriers. The Financial Times highlights the scale of data loss, noting tens of millions of records exposed. In contrast, the National Police Agency focuses on the technical precursor, reporting a 50% surge in suspicious scans from the US, Netherlands, and other nations, suggesting a global increase in reconnaissance activity rather than solely AI-driven execution. While Gizmodo frames the situation as a 'hellscape,' PCMag notes that while AI is a factor, Japan's chronic underinvestment in cybersecurity also makes it a target-rich environment.

Why it matters

The declaration of a national cybersecurity emergency signals a shift from reactive defense to proactive regulatory intervention, particularly in financial identity verification. The surge in pre-attack scans indicates a coordinated, large-scale reconnaissance effort, potentially leveraging AI to identify vulnerabilities across diverse sectors, from retail to rail. This event underscores the growing risk of AI democratizing cyberattacks, making even smaller entities viable targets and necessitating stricter ID protocols to prevent identity fraud.

What to watch

Regulators will likely enforce stricter ID verification standards, such as requiring chip-based IDs for new accounts. Businesses may face increased pressure to upgrade outdated IT systems and invest in AI-based defensive measures. Police will continue monitoring suspicious scan patterns, particularly from high-traffic source countries, to preempt further attacks. The government may expand emergency response protocols to include AI-driven threat detection and mitigation strategies.