Dallas – October 12, 2026 -- Japan recorded more publicly disclosed cybersecurity incidents in the first nine months of 2026 than in all of 2025, according to TrendAITM Forward-Looking Threat Research data. TrendAITM, the enterprise business unit of Trend Micro Incorporated (TYO: 4704), issued a threat advisory for Japanese organizations after a senior ruling-party lawmaker declared that "cyberspace is in a state of emergency."
September incidents rise 37% from July to 86
September alone saw 86 incidents, about 18% more than August and 37% more than July. Masaaki Taira, who chairs the Liberal Democratic Party's National Cybersecurity Strategy Headquarters, made the emergency statement. The headquarters met on Oct. 9 and called on the government to strengthen public-private cooperation.
Breaches at retailers, financial services firms, a car-sharing service and a rail operator have exposed the data of millions of customers. The National Cybersecurity Office has sent guidance to ministries, local governments and private companies. It covers keeping security protection up to date, using strong passwords and tightening security across supply chains.
Attackers plant web shells through known flaws in public-facing applications
The TrendAITM Incident Response team has also seen a rise in Japanese cases. In recent engagements, attackers exploited known vulnerabilities in public-facing applications to install web shells on web servers. That foothold lets them attempt privilege escalation, lateral movement or access to connected databases.
TrendAITM finds no AI link to Japan attacks but warns of lower attacker costs
TrendAITM has not established a connection between the Japanese incidents and attackers' use of AI. It says AI does speed up reconnaissance and vulnerability analysis, and it can produce convincing phishing in languages attackers do not speak. That weakens the protection languages such as Japanese once offered against foreign attackers. Automation also makes smaller organizations, including suppliers, more attractive targets because of the higher return on investment for cybercriminals.
Robert McArdle, Director of Forward-Looking Threat Research, said the surge should be seen as "the new baseline of attacks" that will grow in volume and speed. He noted a robust economy already exists for stolen accounts, APIs and tokens. Ryan Flores, Co-lead of the research team, said organizations need to shrink their cyber exposure and close vulnerabilities.
TrendAITM lists six hardening priorities for Japanese enterprises
- Patch internet-facing systems first, prioritizing actively exploited vulnerabilities and using virtual patching to cover gaps during testing.
- Harden web servers by restricting write access to application code and isolating file-upload directories.
- Monitor sensitive database operations and run applications with minimum-privilege database accounts.
- Check suppliers on incident notification, third-party custody of customer data and independent recovery of critical services.
- Replace verification that relies solely on uploaded photographs of identity documents with chip-based or other stronger methods.
- Bring AI applications, models and agents into security scope, including their access to sensitive data and internal systems.
Vision One AI Risk Insights reaches general availability in January 2027
TrendAITM will add AI Gateway and AI Risk Insights solutions, including digital asset reputation scoring, to its Vision One AI security suite in December 2026. AI Risk Insights is scheduled for general availability in January 2027. The tools target shadow AI, sensitive data sent to external services, and AI agents connected to internal systems with excessive permissions.
TrendAITM researchers and incident responders are tracking the activity behind the current wave of Japanese incidents and will publish further findings.