Japan cybersecurity brief · Updated 7 October 2026

Breaches, new rules and security leadership in Japan.

The major breaches disclosed in Japan over the past year, what they cost, the rules that start now, and what it means for hiring. Every figure is linked to its source, most of them published only in Japanese.

123
ransomware reports to police in the first half of 2026, the most for any half-year since 2020
警察庁 (National Police Agency) via @IT
30.64M
people affected by personal data leaks at listed companies in 2025, up 93.1% on 2024
Tokyo Shoko Research via Web担当者Forum
¥586B
security software market in 2024, up 14.6%, forecast to pass ¥1 trillion by 2029
IDC Japan, May 2025
42%
of Japanese security professionals say their organisation can't get the people it needs, against 29% worldwide
ISC2 workforce study, December 2025

Breaches

Major breaches disclosed in Japan, September 2025 to October 2026.

Nine incidents, newest first, taken from the companies' own disclosures and the reporting on them. Figures are the latest each company has published.

CompanyDisclosedWho was affectedHow it happenedWhat followed
Monogatari CorporationYakiniku King app · ASCIIOct 202610,788,963 app members: name, email and phone number. Passwords and payment data were not exposed.Unauthorised access, found 2 October. Cause still under investigation.Investigation continuing.
Times Mobility (Park24)Times Car · company noticeSep 2026About 1.6 million accounts had ID document images taken, including driving licences.Unauthorised access to the Times Car web system.External investigation under way.
Aflac Life InsuranceScanNetSecurity · Kumamoto NichinichiJun 2026About 4.38 million customers, about 230,000 of them with bank account details.Unauthorised access between 15 and 25 June, including the policyholder portal. Aflac later said it lacked controls to detect bulk data queries.Financial Services Agency report order under the Insurance Business Act, 30 June.
Regulator acted
KDDIISP email platform · @ITJun 2026Up to 14.22 million email addresses and passwords across six ISP brands, including BIGLOBE, @nifty and J:COM NET.A vulnerability in third-party software used by the system.
Third party		Users asked to change passwords.
Anabuki Housing ServiceScanNetSecurityMar 2026207,773 records, the final count in June. The first estimate was about 496,000.Ransomware.Final report June 2026.
Washington HotelScanNetSecurity · final report summaryFeb 2026Some servers encrypted. No confirmed theft of data.Ransomware, through a device connecting the network to the outside.
Network edge		Card terminals down at some hotels. Restored from backups. Final report September 2026.
Nissan MotorScanNetSecurityDec 2025About 21,000 customers.Unauthorised access at a contractor (Red Hat).
Third party		Customers notified.
AskulImpress Watch · NikkeiOct 2025About 740,000 records, mostly business customers.Ransomware. The way in was a contractor's administrator account that did not have multi-factor authentication.
Third party		Net loss of ¥22.1 billion for the year to May 2026.
Financial loss
Asahi Groupcompany noticeSep 2025Ordering and shipping stopped across its Japanese companies.Cyber attack on 29 September 2025.Expected 2025 revenue about ¥60 billion below plan.
Financial loss
3 of 9
came in through a contractor or third-party software: KDDI, Nissan and Askul.
3 of 9
were ransomware: Anabuki, Washington Hotel and Askul.
226
ransomware reports to police in 2025, about 60% of them at small and mid-sized companies. (警察庁 2025)

For scale: the two largest leaks in 2025 were Kaikatsu Club (AOKI Holdings) at 7.29 million people and Sompo Japan at 7.27 million, both through unauthorised access to internal servers. Tokyo Shoko Research counted 180 leak incidents at listed companies in 2025, 64.4% of them from unauthorised access or malware (via Web担当者Forum). Figures checked 7 October 2026.

What changes now

Two sets of rules arrive this financial year.

One started on 1 October. The other is due in the second half of FY2026.

From 1 October 2026

Active cyber defence law

The main obligations of Japan's new active cyber defence law started on 1 October 2026.

Trend Micro on the law (Japanese)
Second half of FY2026

Supply chain security ratings (★3 and ★4)

The government's supply chain security ratings are due to start once their evaluation guides are published. Three of the nine breaches above came in through a contractor or third-party software.

IPA, SCS ratings (Japanese)

What it means for hiring

Security vendors

Selling security into Japan

  • ¥586 billion security software market in 2024, up 14.6%, forecast to pass ¥1 trillion by 2029.IDC Japan, May 2025
  • Your buyers now have a law in force and supply chain ratings their own customers will ask about. In our searches, that is when vendors move from a sales lead to a Country Manager who can sit with the buyer's executives.
Most of our security work is the Country Manager seat. The track record is below.
Consulting firms

Running a security practice

  • ¥882 billion to ¥1.41 trillion: IDC's forecast for the business consulting market from 2025 to 2030, across all consulting work, with enterprise AI the main driver.IDC Japan, June 2026
  • 6.63 job openings for every consulting and finance job seeker on doda in August 2026, up from 6.00 a year earlier.doda 転職求人倍率
Hiroshi Torobu runs our consulting searches, including Partner appointments at a Big 4 firm in Japan.
CIOs and security leaders

Running security at a Japanese company

  • 42% of Japanese security professionals say their organisation can't get the people it needs, against 29% worldwide.ISC2, December 2025
  • At Askul the way in was a contractor's administrator account without multi-factor authentication. Aflac received a report order from the Financial Services Agency within days of its breach.
We map the security leaders in Japan who could run your function and score them against your current leader, on a private page. Nobody is approached.

Track record

Country Manager searches for security vendors, and Partner searches in consulting.

Most of our security work is the top seat in the country. These are completed searches.

Recorded Future
Country Manager

A confidential replacement to stabilise the team, then the leader who took the business through the merger into Mastercard.

Splunk
Country Manager

A confidential replacement at the top of the country. The team grew from fifty to 120 people and contract sizes got much larger.

Fastly
Country Manager

A confidential replacement. A cloud-native sales leader hired out of a hyperscaler's Japan cloud business.

SUSE
Country Manager

Hired out of a sitting country president role, then a senior partner executive into the same business.

Chainalysis
Country Manager

Selling into Japanese law enforcement and financial regulators. The leader placed now hires the team beneath him.

Zenity
First Country Leader

An early-stage US vendor with no entity, no brand recognition and no reference customer in Japan. Run exclusively.

Rapid7
Country Sales Leader, then Sales Engineer

Placed twice. The sales engineer came out of a consulting firm rather than from a competitor.

Big 4 consulting firm
Partner, several appointments

Partner placements into a Big 4 firm in Japan. We don't name the firm, because at Partner grade that identifies the person.

Also in enterprise technology

Glean First Country ManagerGitHub First Country ManagerCelonis Country ManagerZendesk Country ManagerNutanix Exclusive agent, five to fiftyWorkday Embedded team buildFivetran First enterprise seller

Searches led by Murray Clarke, including work at the firms he built before Aspiring Partners, and by Hiroshi Torobu in consulting. We hold back candidate names because the people are identifiable. Every client listed will take a reference call. Full track record

References

What our clients say.

Eighteen regional leaders and global heads of talent who have run searches with us. Every one of them has agreed to take a call.

“I've worked with the team for many years now and they helped me hire the key leader to scale our Japan business, and the one to take us through the merger into Mastercard. Great work.”

DQ Li
VP Asia Pacific, Recorded Future

“Instrumental in hiring key people, including Country Manager, and delivering RPO. Their network in Japan is significant.”

Goh Hattori
Global Talent, Splunk and Dell EMC

“Helped build our presence in Japan during a difficult time of year and for a very niche sector. Diligent, up front, and focused on delivering.”

Anwar McEntee
APJ Region Head, Rapid7

“Impressive research and a job well done. Thanks for the great work. Happy to be a reference.”

Josep Garcia
VP Asia-Pacific, SUSE Software

“We almost exclusively found Murray to be our go-to recruiter. I highly recommend him.”

Matt Young
Asia Pacific VP, Nutanix

“One of the top recruiters VMware has worked with, not only in Japan, but across the whole of Asia Pacific. He is exceptional.”

Kate Berkeley
Global Talent, VMware

“Murray has been a tremendous help in hiring dozens of individual contributors as well as key managers for us.”

Jon Robertson
Japan President, VMware

“Great job Murray. Thanks so much for this. We are really happy with this key hire.”

TJ Chandler
Asia Pacific VP, Fivetran

“Excellent work to hire a key sales lead for our new all-flash product in Japan.”

Barry Kent
Flashblade VP, Pure Storage

“Murray helped us lock in a key leader for our Japan business. He did an excellent job.”

Mathew Fleming
Global Sales Director, Fusion-io (now Sandisk)

“If you need someone to assist as you try to enter the Japanese market, don't look any further.”

Gerry Sillars
Asia Pacific VP, CommVault

“Thanks for your work. Nice job. I appreciate you running at a very intense pace.”

Anthony Palladino
CRO, mabl

“I see Murray as the only recruiter that really understands the markets he recruits into.”

Brian Burns
VP, Hortonworks

“Murray was invaluable. His advice, cultural guidance, and results were outstanding.”

Stephen Beck
Global Services VP, VMware

“Murray can build a strong relationship and he drives things very passionately.”

Keita Nozaki
Technical Services Head, VMware

“Murray helped build our Japan team, securing high quality sales and engineering hires.”

Sung Hae Kim
Global HR Head, Pivotal

“His business sense and creativity helped fill a high level executive position in a short period of time.”

Matt Thatcher
International Sales Director, DoubleTake Software

“Murray has done outstanding work for PARC in a difficult talent space. Thank you.”

Patrick Cook
Global Head, Xerox PARC

Every name above agreed to be listed and to take a reference call. See the full track record on aspiringpartners.jp.

Further reading

More from our Japan research.

Market brief

Why Japan in 2026

Japan's software, cloud, AI and security markets, the hiring market, and our placements in five segments, with every figure sourced.

Read the brief →Research · Leadership

Japan Head Appointments Register

Every new head of Japan at a non-Japanese enterprise technology company from 2024, by month, with the source for each appointment and the share held by women.

Open the register →Research · Leadership

Women in Leadership in Japan 2026

How many of Japan's new tech country heads are women, and where the few come from. With national data and sources.

Read the article →Case study · Cloud security

Wiz in Japan

Wiz launched its Japan business in November 2024, named a former president of VMware Japan to lead it and began hosting customer data in Tokyo and Osaka. About a year later it had 80 new customers and 60 partners in Japan.

Read the case study →

Next step

Talk to the partner who would run the search.

Thirty minutes on the role, the market for it and what it will take to hire well. You leave with our view of that market whether or not it becomes a search.

Murray Clarke
Murray Clarke
Founding Partner · Security vendors and enterprise technology
  • Placing Country Managers and presidents in Japan since 2003
  • More than 70 Country Manager appointments
  • ManpowerGroup (NYSE: MAN) bought his last search firm and made it Experis Executive
  • Recorded Future, Splunk, Fastly, SUSE, Chainalysis and Zenity among his security searches

murray@aspiringpartners.jp · +81 90 8383 9025

Book with Murray →
Hiroshi Torobu
Hiroshi Torobu
Partner · Consulting and professional services
  • Eleven years recruiting in Japan, on executive and senior appointments across consulting, technology and manufacturing
  • Partner appointments into a Big 4 consulting firm in Japan
  • Country Manager appointments for overseas firms setting up in Japan

Partner, Managing Director and Director searches inside consulting firms.

Book with Hiroshi →

How this page was researched. We produced this page with AI under Murray Clarke's direction. Every figure was checked against its original source on 7 October 2026, and each source is linked beside its figure. Most are Japanese-language company disclosures, National Police Agency figures, IDC Japan and Tokyo Shoko Research. Murray Clarke is accountable for what the page says. If you find an error, tell us at hello@aspiringpartners.jp and we will correct it.

Aspiring Partners K.K. Licensed by the Ministry of Health, Labour and Welfare for fee-charging employment placement, licence 13-ユ-318925. Company names in the breach table describe public incidents and are not clients. Where we ran a search for a company, we say so. Nothing on this page is legal or security advice. aspiringpartners.jp