Japan Urges Banks to Strengthen Cybersecurity After Breaches Affect Millions

Key Takeaways

• Japan Issues Cybersecurity Warning: The Financial Services Agency urged banks to review their cybersecurity defenses, third-party risk management and incident response arrangements following a series of significant cyberattacks.
• Millions of Customer Records Affected: Recent breaches involving Times Car Rental and Lawson affected approximately 6.6 million accounts and 2.15 million customer records, respectively.
• Stronger Identity Verification Urged: Finance Minister Satsuki Katayama called for tighter account-opening procedures, including the use of identification cards with electronic chips to combat fraud involving stolen personal information.
• Government Expands Cybersecurity Response: Japan's National Cybersecurity Office and Ministry of Internal Affairs and Communications have called for stronger authentication, vulnerability management and contractor security measures.
• Cybersecurity Emergency Raised: Former digital minister Masaaki Taira described the situation as a cybersecurity emergency amid a series of attacks affecting businesses and public institutions.

Deep Dive

Japan's financial regulator has urged banks to strengthen their cybersecurity defenses following a series of attacks that exposed millions of customer records and prompted a senior government official to describe the situation as a cybersecurity emergency.

The Financial Services Agency (FSA) issued a warning on October 9, calling on financial institutions to review their existing security measures, identify deficiencies and take corrective action. The notice specifically addressed third-party risk management and incident response arrangements, placing responsibility on institutions to assess whether their protections remain adequate.

The warning followed several significant breaches involving Japanese businesses, including car-sharing services, convenience stores and other organizations holding substantial amounts of customer information. Rail operators, automobile manufacturers, karaoke chains and police authorities have also been affected by cyberattacks.

At an emergency meeting of the National Cybersecurity Strategy Headquarters, former digital minister Masaaki Taira described the situation as a "state of emergency in [the] cyberspace," according to reporting by the Financial Times.

Finance Minister Satsuki Katayama also addressed the attacks during an October 9 press conference, urging financial institutions to strengthen identity verification procedures for customers opening new bank accounts.

"In recent years, there have been a series of unauthorised access incidents in various industries, resulting in numerous cyber incidents in which customer information, including images of identity verification documents, has been leaked," Katayama said.

She called for appropriate verification mechanisms, including the use of identification cards containing electronic chips, as authorities seek to prevent stolen personal information from being used to open fraudulent accounts.

The concern follows breaches in which identity documents and other sensitive customer information have been compromised. Such information can be used in attempts to impersonate individuals, making account-opening procedures an important part of the financial sector's response.

The scale of the recent incidents has added urgency to the government's warnings.

In late September, Times Car Rental, a Japanese car-sharing service, disclosed a data breach affecting approximately 6.6 million accounts. Convenience store operator Lawson subsequently reported unauthorized access involving around 2.15 million customer records, with names, email addresses and credit card information potentially exposed.

Together, the incidents involved approximately 8.75 million accounts and records, although that figure does not necessarily represent the number of individual customers affected.

Japan also recorded 123 ransomware incidents during the first six months of 2026, according to figures cited in the reporting.

The recent attacks have prompted warnings from several government bodies, with authorities calling for stronger security measures across both public and private organizations.

Japan's National Cybersecurity Office has urged businesses to identify and address vulnerabilities promptly, improve authentication mechanisms and review the security arrangements of contractors and other external service providers.

The Ministry of Internal Affairs and Communications has issued similar guidance to organizations under its jurisdiction, extending the government's response beyond the financial sector.

For banks, the FSA's October 9 notice places particular attention on the security of third-party relationships and the effectiveness of procedures for responding to cyber incidents. Financial institutions have been asked to examine their current arrangements and address weaknesses identified through those reviews.

The warnings come as authorities seek to limit further unauthorized access to customer information and reduce the potential for compromised identity documents to be used in financial fraud.

Japan's response follows cyber incidents affecting government institutions elsewhere, including attacks targeting public websites in Spain, Norway, Germany and the European Commission. Italy's Ministry of Foreign Affairs recently reported that it had been targeted in a cyberattack, while Danish authorities disclosed a serious incident involving the personal information of approximately 8.8 million people.

In Japan, the immediate focus remains on strengthening existing protections and addressing vulnerabilities across financial institutions and their service providers. The FSA has called for corrective measures where necessary, while Katayama's recommendations place additional attention on how banks establish and verify the identities of new customers.

The government's warnings leave financial institutions with a defined set of responsibilities, from reviewing third-party security arrangements to strengthening authentication and ensuring that incidents can be identified and addressed promptly.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.