Japan Is Calling It a “State of Emergency in Cyberspace.” Banks Just Stopped Trusting Photos of Driver’s Licenses.

In the space of about a month, Japan has watched a car sharing service, a convenience store chain, a karaoke giant, a travel booking site, a railway card and a cloud provider used by hundreds of companies and local governments all report break-ins. Tens of millions of records may be exposed. On October 9, one of the country’s most senior lawmakers on digital policy gave the situation a name: a “state of emergency in cyberspace.”

The fallout is already reaching ordinary people. Japan’s Financial Services Agency has asked banks, brokers, insurers and crypto exchanges to stop relying on photos of ID documents to open accounts, because one of the breaches leaked images of more than a million driver’s licenses.

What was hit

The incidents are not one attack. They are a cluster of separate breaches, some ransomware, some unauthorized access to web systems, that landed close enough together to feel like a coordinated wave.

The one that changed policy was Times Car, the car sharing service run by Park24. In late September the company confirmed that about 6.6 million accounts had been exposed through its web system, and then that images of identity documents, mostly driver’s licenses, had leaked for about 1.6 million of them. Park24 says it has not confirmed any fraudulent use.

Lawson said unauthorized access to its Lawson ID system between September 12 and 14 may have exposed 2,155,345 member records, separate from an incident days later in which its mail server was abused to send about 700,000 spam emails. The biggest single number belongs to Adventure, the company behind the Skyticket travel site, with about 14.64 million records potentially exposed.

Then, at about 3:40 a.m. on October 7, ransomware hit IDC Frontier, a SoftBank subsidiary that runs cloud infrastructure for businesses and public bodies. Japanese reports put the number of affected customers at 495 companies and local governments, with prefectural and city websites among the services knocked offline. IDC Frontier has warned that some customer data may not be recoverable. Other names that have surfaced in the wave include FamilyMart, Bookoff, Keio Plaza Hotel and Daiwa Securities.

Who said “emergency,” and what it means

It is worth being precise here, because some headlines have made this sound like a formal government decree. Masaaki Taira, a former digital minister, made the remark at a meeting of the Liberal Democratic Party, where he leads the party’s cybersecurity strategy headquarters. It was a political warning, not a legal state of emergency with special powers attached.

Taira said the breaches bear the hallmarks of “saturation attacks,” large-scale automated attacks that exploit AI to hit many targets at once. Toshiharu Furukawa, a cabinet minister involved in the government’s response, called the situation “extremely critical” and admitted that “progress in clarifying the details of these incidents has been slow.”

Why banks will stop accepting license photos

Japan already planned to retire photo-based identity checks. Under rules set in 2025, financial firms must stop opening accounts on the strength of an uploaded image of an ID card from April 1, 2027. On October 9, the Financial Services Agency asked them to make the switch now.

The National Police Agency has also urged businesses to tighten identity checks. For people in Japan, the practical result is that opening a bank or brokerage account online will increasingly mean tapping a My Number card against a phone rather than snapping a picture of a license.

Is AI really behind it?

This is where the story gets more complicated than the headlines. The claim that AI is fueling the wave comes from Taira’s remarks and from security analysts, not from forensic findings on these particular breaches. Security firm TrendAI, which has tracked a sharp rise in Japanese incidents this year, says it has not established a link between the recent attacks and AI.

There is real evidence that AI is entering the toolkit, though. Cisco Talos assessed with medium to high confidence that Python tools found on a server linked to the Qilin ransomware group, the group that has hit Japan more than any other, were written with help from a large language model. The tools were built to break into Active Directory and disable Veeam backups, two things that make ransomware attacks far more damaging. Analysts also point to a quieter shift: AI translation has erased much of the language barrier that once made Japanese targets harder for foreign gangs to phish and extort.

We have already seen how this can look at full speed, from the first ransomware attack run almost entirely by AI to Bill Gates warning that AI-assisted hacking will bring “a lot of negative surprises” this year.

The numbers were climbing before this month

Japan’s ransomware problem did not start in September. National Police Agency figures show reported cases holding at a high level for three years, and the first half of 2026 set a half-year record.

The police data shows who is getting hurt. Of the 123 cases in the first half of 2026, 79 hit small and midsize businesses, manufacturing was the most targeted sector, more than half of victims needed over a month to recover, and 60% suffered losses above ¥10 million.

A country that has been warned before

Several of Japan’s biggest recent incidents have followed the same pattern: one breach at a supplier or platform cascades into disruption for millions of people.

Japan’s answer on paper is the Active Cyber Defense law passed in May 2025, which lets authorities monitor some international traffic, neutralize attacker servers and require critical infrastructure operators to report breaches. Taira led the preparation of that law as digital minister. But it is being phased in, with full operation targeted for 2027, which leaves the country fighting this wave with older tools.

What to do if you use these services

• Check notices from each company. Times Car, Lawson and the others are contacting affected customers. Watch for their official emails, and do not click links in messages that only claim to be from them.
• Change reused passwords. If you used the same password for Lawson ID, Skyticket or Times Car anywhere else, change it there first.
• Expect better phishing. Leaked names, emails and booking details make scam messages far more convincing, especially now that AI can write flawless Japanese.
• Watch your financial accounts. If your license image was in the Times Car leak, be alert to accounts or loans opened in your name.

The word “emergency” may have come from a party meeting rather than a cabinet decree, but the numbers behind it are real. And the fastest change so far is not a new law. It is banks quietly deciding that a photo of a card is no longer proof of anything.

Sources and further reading

• UNILAD Tech: Japan declares ‘state of emergency in cyberspace’ as AI unleashes mass ransomware waves
• Financial Times: Japan’s cyberattack wave
• Nippon.com / Jiji Press: LDP’s Taira warns of state of emergency in cyberspace
• The Japan Times: Driver’s license data breach spreads
• BleepingComputer: Ransomware attack disrupts Japan’s IDCF Cloud
• Nippon.com / Jiji Press: Ransomware cases hit half-year record
• Reuters via The Star: Ransomware attacks have swept Japan, and AI may be making them easier

About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.