Japan Declares Cybersecurity Emergency After Record Breach Wave

Japan's Financial Services Agency has declared a cybersecurity emergency after the country suffered more incidents in the first nine months of 2026 than in all of 2025, according to data from TrendAI shared with Reuters.

Key Details

Over 20 major firms including Lawson convenience stores and Times Car rental reported breaches, exposing tens of millions of customer records. The FSA now urges lenders to accept only ID-chip-enabled identification such as passports or MyNumber cards, following the leak of driver's licence images from the Times Car attack.

Why It Matters

The emergency declaration signals a shift from voluntary to mandatory security upgrades across Japan's financial sector, with potential global implications for how regulators respond to AI-amplified credential theft and identity fraud.

Context

AI tools have lowered the effort required to exploit stolen credentials at scale, making smaller services viable targets. Japan's response may preview regulatory moves in other jurisdictions facing similar threat escalation.