Did Japan Really Declare a Cyber Emergency? What Actually Happened

No. Japan did not declare a cyber emergency.

You may have seen the headlines: "Japan declares first cyberspace emergency" and "AI attacks incoming." My company has run an online service in Japan for 22 years, so I read the original notices, in Japanese, the day they come out. I made a video about this, but a video can only show a few lines from each document. This article goes through the documents themselves: the ruling party's report, the government's notice, and all seven notices from the cloud provider at the center of it, including the final report that came out after I recorded the video.

I also made a video of this.

The short version

• There was no legal declaration. A politician called the situation "an emergency" at a party meeting on October 9. Nothing was switched on.
• The government's own notice that day was a checklist for companies, not an emergency order.
• The government told that meeting it was not clear the incidents were connected, or that AI was misused.
• The real damage I care about: ransomware at IDC Frontier, a cloud provider owned by SoftBank, stopped servers for 495 companies and local governments on October 7.
• On October 8 the provider said data in those zones could only be restored from backups customers kept themselves. Later, 206 of the 495 got backups out. Extraction started on October 17, ten days after the attack.
• The way in, according to the final report: a vulnerability in open source software used by the customer portal's login system.

What actually happened on October 9

The ruling Liberal Democratic Party has its own National Cybersecurity Strategy Headquarters. It is a party body, not a government agency. On October 9 it met and heard from the government about a series of personal data leaks from private companies.

The party published its report of that meeting on October 14. Its head, Masaaki Taira, said cybersecurity "has entered a new phase, and is now in a state of emergency, a crisis." He also said it is important that "not only the government, but the people too" face it.

That's a strong statement. But it is a politician's words at a party meeting. It is not a declaration under any law, and no system or power was triggered by it.

What the government's notice really says

The same day, the government's National Cybersecurity Office published a four page document titled "Response in light of leaks caused by unauthorized access." I read the PDF. It says the office has confirmed several cases where companies holding large amounts of personal data were broken into through web system vulnerabilities, through their supply chain, or because their data handling was weak.

Then it lists what companies should do, in three areas.

Area	What the notice asks for (selected)
Web systems	Assume you can be attacked at any time. Patch the OS, middleware and CMS quickly. Stop using unsupported versions. Turn off systems and features you don't use. Use multi-factor authentication. Disable accounts of people who left
Supply chain	Check your contractors' security not only when you sign, but continuously. Put a duty to report breaches into the contract. Give contractors only the data they need, and make them delete it when the job ends
Data	Know what data you hold and where. Delete what you no longer need. Don't store passwords in plain text. Protect your backup data too. If you use a cloud service, check the public settings and access rights of storage and databases

It is a good checklist. It is also clearly a request, written in polite official Japanese: "please consider thorough measures promptly." There is no order, no deadline and no penalty in it.

Was AI behind it?

A lot of headlines say AI is behind this wave.

Here is what the party's own report says the government told the meeting: at this point, it is not clear that the incidents are connected, and it is not clear that AI was misused. The government then gave three points to act on quickly: judge the risk of web system vulnerabilities and update fast, know the security of your contractors and limit what you share with them, and decide which information assets matter most and watch them for suspicious access.

Experts can have opinions. But "AI attacks incoming" is not what the government said.

The real story: IDC Frontier

For me, the story that matters is a different one.

IDC Frontier is a cloud provider owned by SoftBank. On October 7, at about 3:40 in the morning Japan time, ransomware hit part of its cloud: four zones in its East Japan Region 1 (named tesla, henry, pascal and joule). Virtual servers stopped and could not be restarted.

495 companies and local governments were affected. Rail companies, an airline, a department store. A food logistics company had to stop shipments. City websites went dark.

Then, on October 8, came the sentence every business owner should read twice. IDC Frontier said the customer data stored in those zones would be hard to take out or restore, and that, in its view at that time, data could only be restored from backups customers kept themselves.

Your provider is telling you: we can't get your data back. Only you can.

It also told customers in the zones that were not hit to take their own backups, and it stopped the customer management console in every region. So even customers whose servers kept running could not manage them themselves. IDC Frontier staff started, stopped and changed servers for them on request.

October 7, hour by hour

The final report, published on October 27, includes a timeline of the first day. I hadn't seen it when I made the video.

Two things stand out.

First, it took about eight hours from the first alarm to the point where the cause was named as ransomware. For the first two hours and forty minutes, it was handled as an outage, not an attack.

Second, the first defensive moves were to stop the customer portal and to cut off the storage of the four zones. As the final report later showed, the portal was exactly where the attacker came in.

How the attacker got in

The final report answers the question everyone was asking.

• The attacker exploited a vulnerability in open source software used by the login system of the "IDCF Cloud Portal," the site customers use to start servers and check bills.
• From that login system, the attacker went through the management console and took administrator rights on the virtualization platform.
• With those rights, the attacker stopped customers' virtual servers and encrypted the virtual servers themselves.
• The report says no data inside customers' virtual servers was taken out.
• IDC Frontier says it never contacted the attacker and paid no ransom.

The portal itself was a second problem. On October 14 the company said registration details of 48 customer companies had been looked up by the attacker. By October 27 that grew to up to 71 companies, including names or email addresses that may contain names for up to 31 of them. For up to 4 customers, the portal login password had been changed by the attacker. Those were reset.

The fixes it lists are the kind every SaaS operator should recognize: rebuild the portal in a new environment, change the credentials of every server behind it, move login to an outside identity provider, allow portal access only from each customer's IP addresses, require multi-factor authentication, keep a full software parts list (an SBOM) and match it against vulnerability news automatically.

Who got their data back, and when

To be fair, the news got better.

• October 14: after checking that the backup data was safe, IDC Frontier said 194 customers who used its snapshot feature could get their backup data out. It also said it found no sign that data inside customers' servers was taken.
• October 17: it started taking out backup data and handing it over.
• October 18: it restarted its "IDCF Cloud Backup" service for the regions that were not hit, so those customers could take backups and restore them to other clouds or their own servers. The snapshot feature itself stayed stopped.
• October 20: the number of customers whose backups could be taken out rose to 206.

Now do the math. 495 hit. 206 with backups the provider could hand back. That leaves 289 customers who, as far as the notices show, needed their own backup or a rebuild.

And look at the dates. Even the lucky ones, whose backups lived inside the same provider, waited until October 17 for their data. The backups were there. They were just behind the same locked door as everything else.

The portal is reopening in three stages: first IDC Frontier staff do the main operations for customers, then all operations, and only then customers get the portal back. As of October 27, it was still in the first stage.

What the English coverage got wrong

Some English articles say the attack happened on October 8. It started on October 7.

Others say data can only come from customer backups. That was true on October 8. It changed on October 14.

Some throw around a figure of over 14 million people affected. I couldn't find that number in any official notice.

Small things? Maybe. But if you're deciding what to do based on a headline, small things add up.

What 22 years taught me

In the first week of any incident, the official notice is boring. The headlines are exciting. Trust the boring one.

The IDC Frontier notices are a good example. They are dry, they repeat themselves, and they change as the facts change. But every number in this article came from them, and every number held up.

And the real lesson here isn't about AI, or emergencies. It's about where your backup lives.

Four things to do today

1. Keep a copy of your data outside your cloud provider. A different provider, or at least a different account. A snapshot inside the same cloud is better than nothing, but at IDC Frontier even the snapshots took ten days to come back.
2. Actually test a restore. A backup you've never restored is just a hope.
3. Write down how you'd rebuild somewhere else. Which servers, which settings, which DNS records. IDC Frontier's advice to hit customers was exactly this: build a new environment and restore your own data into it. Could you do that in a day?
4. When the next scary headline shows up, go to the source. The company's own notice. The government's own document. It takes five minutes, and it'll save you from a lot of bad decisions.

Your turn

Did any service you rely on go down in this wave? Tell me in the comments on the video. I read every one, and I'll reply.

Sources: LDP National Cybersecurity Strategy Headquarters report (October 14, 2026, Japanese); National Cybersecurity Office, "Response in light of leaks caused by unauthorized access" (October 9, 2026, Japanese PDF); IDC Frontier notices No. 3 (October 8), No. 5 (October 14), No. 6 (October 18) and No. 7, the final investigation report (October 27, updated October 28), all in Japanese. Read on November 2, 2026. Translations of quotes are mine.