Japan Declared a Cyber Emergency After a Record Breach Wave

Japan answers a breach wave with emergency measures

On November 6, 2026, Japan government compiled an emergency package of cybersecurity countermeasures, and the National Police Agency opened a nationwide joint investigation into the large breaches of the past year. The trigger was a week in which the numbers kept climbing: the Arara Message email-delivery breach passed 81 million exposed email addresses, retailers Nojima and Iris Plaza and the beauty site @cosme joined the victim list, and SEGA arcade network went dark.

The week in numbers tells the story. Japan Cyber Watch now counts 61 breaches of a million records or more in 2026, up from 49 just a week earlier. Arara Message alone accounts for 81.33 million email addresses, after attackers moved from a shared environment into servers it runs for each client. MUJI reported 27.26 million records, including 1.09 million full card numbers. Nojima lost about 7 million records from its online store, Iris Plaza about 7.7 million people, and @cosme about 3 million. SMBC Consumer Finance disclosed up to 320,118 borrowers affected, and NTT Docomo about 300,000.

What the emergency package actually does

The package was ordered by Prime Minister Takaichi on October 26 and compiled at the second Cybersecurity Related Ministers Meeting on November 6. Its full text has not been published, which is itself worth noting: the government announced action before publishing the detail. What is public is the structure. The National Police Agency set up a nationwide joint investigation headquartered at the Kanto Regional Police Bureau Cyber Special Investigation Department, with a separate headquarters for the GMO case at the Tokyo Metropolitan Police Department.

The GMO case is the one that forced the government hand. GMO held its first press conference on November 2, and according to Kyodo the attacker entered a customer server environment on August 5 and went unnoticed until October 20. A 2024 warning from its own security subsidiary had been closed with a temporary fix. A two-and-a-half-month dwell time, plus a warning that was never properly closed, is the kind of failure that turns a breach into a political problem.

The Arara breach keeps growing

Arara Message is an email delivery provider, which is why its breach is so large and so messy. Its second and third reports raised the count from 3 million to 81.33 million email addresses, and its clients have begun publishing their own numbers: Asoview reported 15.82 million records exposed through Arara. The figures overlap and mix records with people, so they cannot simply be added together, but the scale is clear. One compromised supplier exposed the customers of dozens of companies at once, which is exactly the supply-chain pattern security teams have warned about for years.

The same pattern showed up at SEGA. On November 1, SEGA Fave stopped its ALL.Net arcade network and Aime player cards after unauthorized access, leaving arcades across Japan dark for a week. The incident is a reminder that breaches are not only about data: when the system that runs the service is the thing that gets hit, the service stops.

What this means outside Japan

Japan breach wave is a case study in two failures that apply everywhere. The first is supplier risk. Arara was one vendor, and its compromise became dozens of companies breaches. The second is dwell time. Attackers who sit inside a network for weeks or months do far more damage than attackers who are caught in days, and GMO 76-day gap is the extreme version of a common problem.

The government response is also a signal. When a prime minister orders an emergency package and the national police open a joint investigation, the message to companies is that breach disclosure and basic hygiene are no longer private matters. Expect tougher expectations on suppliers, faster disclosure, and real consequences for warnings left unclosed.

For individuals, the practical advice has not changed, but the urgency has. Check whether your data was in a breach and change any password that appears in one, especially if you reused it anywhere else. The October breach wave followed the same five mistakes, and November is showing that nobody fixed them in time. The wave will keep growing until the basics get done.