Japan's Cybersecurity Black Swan: 100 Billion Yen and Still

Japan spent 100 billion yen on its cyber defense, then watched 57 million records leak.

Something went wrong at the top.

Since September, Japanese companies have been publicly confessing to data breaches at a pace that suggests a systemic failure rather than isolated lapses. Between September 1 and October 6 alone, nearly 60 percent of all cases involving more than 100,000 compromised individuals were Japanese. The total number of exposed personal records: 57 million.

That includes driver’s license information, photographs, and deeply personal data from consumers who had no reason to expect their identities would be dumped on hacker forums. The Times Car breach—6.6 million members affected—struck particular nerves because it made the abstract violence of a data theft visceral. You could see your own face in the leaked files.

Russian-speaking hacker collective Qilin did not shy away from commentary. It told TBS that Japan is among the worst-equipped countries in the world for computer security, and that attacks on Japanese businesses and government agencies are likely to increase. Qilin’s confidence was not born of arrogance. It was born of experience.

The irony is structural, not accidental.

The National Cybersecurity Office started operations on October 1.

One year before that, Japan passed the Cybersecurity Response Capabilities Enhancement Act. The law authorized the creation of the National Cybersecurity Office, or NCO—a centralized command post inside the prime minister’s office, staffed by roughly 240 officials led by a cabinet-level cybersecurity commissioner at the rank of deputy minister. The budget doubled to 10.7 billion yen.

The mandate was ambitious. The NCO was designed to function as Japan’s counter-terrorism-style command center for cyber threats: intercepting communications intelligence, detecting attack indicators early, and authorizing what the law calls “active cyber defense”—meaning Japanese police and Self-Defense Force cyber units would move offensively against attacker servers, not just patrol their own networks.

Active cyber defense became legally executable on October 1.

Then the breaches started flooding public view.

The timing is impossible to dismiss as coincidence. Whether the attacks were deliberately timed to coincide with the NCO’s activation remains unclear, but the pattern is unmistakable: a newly empowered, well-funded national cyber command center found itself responding to crises it had supposedly been built to prevent. Government statements issued through the NCO and the Ministry of Economy, Trade and Industry amounted to a reminder to apply OS updates promptly. That is not a strategy.

What the government lacks is not money. It is capability.

Former IT policy minister Taro Kono’s successor as head of the Liberal Democratic Party’s National Cybersecurity Strategy Headquarters, Masaaki Hirano, offered one explanation to reporters: the attacks may represent a new class of AI-driven saturation assault. The logic is straightforward. If artificial intelligence can generate phishing content, identify vulnerabilities, and automate credential-stuffing at scale, the cost of attacking a poorly defended target drops to near zero while the volume of attempts rises exponentially. Japan’s traditional perimeter-defense model—firewalls, antivirus, manual incident response—collapses under that kind of mathematical pressure.

But the deeper problem runs further back than AI. Japan’s cybersecurity architecture has always been fragmented. Each ministry guards its own data. Police handle criminal investigations. The Self-Defense Forces handle military cyber operations. The NCO was supposed to unify that chaos. Unification, however, is not the same as capability. A coordination office without skilled operators, without threat intelligence that reaches real-time, and without the legal authority to compel private companies to harden their systems in advance is still just an office.

The United States is watching closely.

Japan’s cyber weakness is not a Japanese problem. It is an allied infrastructure problem.

The US-Japan alliance has long treated technology and intelligence sharing as a strategic pillar. Semiconductor supply chains, 5G infrastructure, and critical industrial systems all cross the Pacific. A compromised Japanese company is a potential entry point into networks that American partners rely on. The Times Car breach alone—if it included data on suppliers, logistics partners, or government contractors—represents a vector that extends far beyond Japanese borders.

American cybersecurity officials have expressed frustration before about Japan’s reactive posture. The difference now is that the frustration is public, and the scale of the failure is quantifiable. Fifty-seven million records is not a number you recover from with a press release.

Who wins and who loses.

The hackers win immediately. Qilin and similar groups gain reputation, recruitment leverage, and likely monetary returns from selling access. The Japanese government loses credibility at home and abroad. Japanese companies lose customer trust and face regulatory scrutiny. Allied partners lose confidence in shared infrastructure.

The question that matters for East Asia is what happens next.

Japan cannot afford another year of announcing new offices while its data continues to leak. The NCO needs operational authority, not just organizational authority. It needs the power to mandate security standards for critical sectors, to compel breach reporting within hours rather than weeks, and to fund the human capital shortage that no budget increase alone can solve. Japan is short thousands of certified cybersecurity professionals. Throwing 100 billion yen at a staffing gap does not close the gap.

For the US and its partners, the implication is sobering. Japan’s cyber defenses are a fault line in regional security. If China or North Korea decide to test the NCO’s limits—which they will—the response will expose whether Japan’s investment has produced real capability or merely expensive bureaucracy.

The current government has promised stronger measures. So far, the measures amount to reminding people to update their operating systems.

That is not a cyber defense strategy. It is a newsletter.