TOKYO, November 12, 2026 — Japan’s cybersecurity crisis is spreading across its corporate sector, with approximately one in three Japanese companies reporting cyberattacks against their own systems or those of external service providers this year, according to a new Reuters survey.
The findings reveal how businesses are increasingly exposed not only to hackers targeting their internal networks, but also to attacks involving outside contractors, technology providers and other organizations handling their data.
The survey found that around 10% of respondents experienced operational disruptions following cyberattacks, while another 22% reported attacks that caused no damage. Just over half said they had not been targeted, while the remaining respondents were unsure.
The results are raising concerns about the resilience of Japan’s digital economy as companies face increasingly sophisticated threats, including ransomware, phishing campaigns and attacks that may be accelerated by artificial intelligence.
The warning comes as the Japanese government prepares stronger cybersecurity measures following a series of major data breaches involving businesses and public institutions.
And the latest figures suggest that the problem may be much broader than individual corporate security failures.
One-Third of Japanese Businesses Report Cyberattacks
The Reuters survey, conducted by Nikkei Research between October 27 and November 6, contacted 508 companies. A total of 214 responded on the condition of anonymity.
Among those respondents, approximately one-third reported that their own systems or those of external service providers had been targeted by cyberattacks during 2026.
The figures reveal two important categories of exposure.
Around 10% said attacks had disrupted business operations or caused other damage. Another 22% reported attacks without damage.
That distinction matters. Being targeted does not automatically mean that a company suffered a successful data theft, financial loss or prolonged shutdown. But even an attack that causes no immediate disruption can expose weaknesses that businesses need to investigate.
For companies dependent on digital platforms, a successful intrusion could affect customer information, internal communications, payment systems, logistics and business continuity.
The survey also highlights a growing concern: a company may have security measures in place but still be exposed through an external provider.
Third-Party Suppliers Are Becoming a Major Cybersecurity Weakness
One of the most significant findings is the role of external service providers.
Businesses increasingly rely on cloud platforms, software vendors, contractors, payment processors and outsourced IT services. These partnerships improve efficiency, but they also create additional points of vulnerability.
If a supplier’s network is compromised, information belonging to its customers may also be exposed. An attacker may attempt to exploit a less-protected partner as a route into a larger organization.
This is why cybersecurity experts increasingly emphasize supply-chain security rather than focusing exclusively on a company’s own network.
The risk is not theoretical.
A separate analysis published by Nippon.com, citing data from MM Research Institute, found that 485 cyberattack-related information leaks had been recorded in Japan by October 13, already exceeding the 432 cases recorded throughout 2025.
Of the 454 incidents recorded between January and September, 164 — approximately 36% — involved external parties such as contractors or cloud service providers.
The figures come from a different research exercise and use a different methodology from the Reuters poll. They should not be combined as though they measure the same group of companies. However, both point to the growing importance of protecting external business relationships.
The same concern has emerged in Singapore.
WWC ONE MEDIA previously reported how a breach involving Alliance Medinet exposed information connected to approximately 110,000 members associated with insurers HSBC Life, Singlife and Income Insurance. The incident highlighted how customers can be affected when a third-party service provider holding their information suffers unauthorized access.
Read the full report: Singapore Healthcare Data Breach Exposes 110,000 Members as HSBC Life, Singlife and Income Insurance Are Hit — But Could Stolen Personal Details Trigger a New Wave of Scams?.
For Japanese businesses, the message is increasingly clear: protecting internal systems alone may not be enough if external partners have access to sensitive information.
Ransomware Attacks Are Setting New Records
Ransomware remains another major concern for Japanese companies.
In these attacks, criminals use malicious software to lock or encrypt systems and may threaten to publish stolen information unless victims pay.
The Straits Times reported on November 4 that ransomware incidents affecting Japanese companies reached 239 between January and October 2026, surpassing the 228 cases recorded during the whole of 2025.
The figure also represented more than double the number recorded in 2021, according to cybersecurity company Macnica.
The consequences can extend far beyond the initial intrusion.
Companies may lose access to critical files, experience production delays, suspend online services or face expensive recovery operations. If customer information is stolen, they may also face regulatory scrutiny, legal costs and reputational damage.
The financial pressure can be particularly severe for smaller businesses that lack dedicated cybersecurity teams or the resources to recover quickly.
The Reuters poll found that 32% of respondents had strengthened ransomware countermeasures and data backups.
Backups are particularly important because they can help organizations restore systems without relying entirely on attackers’ demands. However, backups must also be protected from unauthorized access and tested regularly to ensure they can actually be restored.
AI Is Making the Cybersecurity Battle More Difficult
Artificial intelligence is adding another layer of complexity to the threat.
Experts say AI can help automate activities such as scanning software for vulnerabilities and creating phishing messages designed to deceive employees.
That can make certain cybercriminal operations faster, cheaper and more difficult to detect.
Phishing attacks are especially dangerous because they target people rather than relying exclusively on technical weaknesses. A convincing email or message can trick an employee into revealing credentials, opening a malicious attachment or approving an unauthorized transaction.
The Reuters survey found that 63% of respondents had strengthened employee security training and anti-phishing measures — the most frequently reported defensive action.
A chemical company official quoted in the survey said perfect protection against AI-driven attacks was difficult to achieve, making damage limitation an important priority.
The concern is also reflected in international cybersecurity reporting.
Reuters reported on November 5 that companies worldwide were facing more frequent and sophisticated attacks as AI accelerated parts of the hacking process. The report cited a sharp increase in reported software and system vulnerabilities during the third quarter of 2026.
AI is not exclusively a tool for criminals, however. Security teams can also use it to identify weaknesses, monitor suspicious activity and respond to threats more quickly.
The challenge is ensuring that defensive capabilities keep pace with the speed at which attackers can adapt.
Japan Plans More Spending on Cybersecurity
Japanese companies are responding by increasing their cybersecurity budgets.
According to the Reuters poll, 59% of respondents expected a moderate increase in cybersecurity spending, while 3% anticipated a sharp increase.
Together, that means 62% expected to spend more.
Another 22% anticipated little change.
Businesses are focusing on several areas:
- Employee training and anti-phishing protection: 63% said they had strengthened these measures.
- Ransomware protection and data backups: 32% reported improvements.
- Information management: 22% said they had introduced stricter controls over personal and confidential information.
Respondents could select multiple measures, so the percentages do not add up to 100%.
The spending plans come as Japan’s government moves to strengthen national cyber defences.
On November 6, Prime Minister Sanae Takaichi announced an emergency cybersecurity package worth ¥10 billion, equivalent to approximately US$63 million.
The initiative includes plans for specialist cybersecurity teams, AI-assisted vulnerability detection and a public-private cyber rescue operation to help organizations respond to attacks.
The government also intends to strengthen cooperation among relevant agencies and improve its ability to respond to threats involving national security.
The package reflects growing recognition that cyberattacks can affect more than individual businesses. They can disrupt essential services, expose sensitive public information and threaten economic stability.
WWC ONE MEDIA previously examined the government’s response in Japan Unleashes ¥10-Billion Emergency Cybersecurity Plan as Hackers Target Millions of Records — But Can Its New AI Defence Teams Stop the Next Attack?.
But announcing a cybersecurity package is only the first step. Its effectiveness will depend on how quickly the measures are implemented, whether businesses can access the support and whether security improvements reach smaller suppliers as well as major corporations.
Recent Data Breaches Show How Much Is at Stake
Japan’s recent cybersecurity incidents have put the risks into sharper focus.
The Associated Press has reported breaches affecting companies including convenience-store operator Lawson, financial services company Daiwa Securities and secondhand retailer BookOff.
Another high-profile incident involved Times Car, the car-sharing service operated by Park24. A cyberattack reportedly exposed information associated with approximately 6.6 million member accounts.
These cases involve separate companies and incidents. There is no basis to assume that all were carried out by the same attackers or through the same method.
Nevertheless, they demonstrate the potential scale of exposure when businesses store large amounts of customer information.
The consequences may include unauthorized disclosure of personal details, targeted phishing attempts, identity-related fraud risks and a loss of customer confidence.
A separate incident involving Singapore telemedicine provider Doctor Anywhere and telecommunications operator M1 also demonstrated how data breaches can affect organizations in different industries.
As WWC ONE MEDIA reported, the two companies disclosed separate cybersecurity incidents involving customer information, raising concerns about the protection of identification and contact details.
The incidents are not evidence of a direct connection to Japan’s current cyberattack wave. They illustrate a wider regional challenge: organizations across Asia are under pressure to protect increasingly large collections of personal and business information.
Why Small and Medium-Sized Companies May Be Especially Vulnerable
Large corporations often have dedicated cybersecurity departments, security monitoring systems and budgets for incident response.
Smaller businesses may not have the same resources.
Yet they can still hold valuable customer information, operate essential services or provide technology and logistics support to much larger companies.
Nippon.com’s analysis found that smaller Japanese businesses were heavily represented in the 2026 information-leak figures. Of the incidents recorded from January to September, 195 involved companies with 300 or fewer employees.
This creates a potential supply-chain problem.
A major company may invest heavily in protecting its own network, but its security can still be affected by a supplier with weaker controls.
That is why cybersecurity assessments increasingly need to include vendors, contractors and cloud providers.
Companies may need to review who can access their systems, limit unnecessary permissions, require stronger authentication, monitor unusual activity and establish clear procedures for reporting incidents.
They also need recovery plans that can keep essential operations running if an attack succeeds.
Japan’s Cybersecurity Spending Race Is Just Beginning
The Reuters survey provides a snapshot of how Japanese businesses are responding to a rapidly changing threat environment.
One-third reported attacks against their systems or those of external service providers. Around one in ten reported operational disruption. More than six in ten expected cybersecurity spending to increase.
But increased spending does not automatically guarantee protection.
Businesses must ensure that investments translate into practical improvements: better employee awareness, stronger access controls, reliable backups, faster incident detection and closer oversight of external providers.
The government also faces the challenge of helping smaller organizations that may struggle to hire cybersecurity specialists or afford sophisticated security systems.
Japan’s ¥10-billion emergency package signals that the government recognizes the scale of the problem. Whether it can meaningfully reduce the risks will depend on implementation and sustained cooperation between public institutions and private businesses.
For now, the warning from the latest Reuters poll is difficult to ignore.
Cybercriminals do not always need to break directly into a major corporation. Sometimes, the weakest link may be a contractor, software provider or outside company trusted to handle sensitive information.
And as artificial intelligence makes some attacks easier to automate, Japan faces a difficult question: Can its businesses secure the entire digital supply chain before the next attack turns another trusted service provider into the gateway to millions of customers’ information?
