Japan's FSA Puts Banks on Notice Over Cybersecurity as Wave of Attacks Prompts National Emergency Declaration
Japan’s FSA Puts Banks on Notice Over Cybersecurity as Wave of Attacks Prompts National Emergency Declaration #
Japan’s Financial Services Agency (FSA) has ordered banks to audit their cybersecurity defences and plug any gaps, after a surge of breaches across multiple industries prompted the government to declare a national state of emergency in cyberspace.
On October 9, the FSA issued a formal notice to financial institutions calling on them to review their existing security measures, identify shortcomings and take corrective action. The notice focused specifically on third-party risk management and incident response procedures, areas where banks must now satisfy themselves that protections are adequate and fix anything that falls short, according to the GRC Report.
Finance Minister Satsuki Katayama amplified the warning in a press conference the same day, urging lenders to tighten the identity-verification processes used when opening new accounts. She called for the mandatory use of chip-enabled ID cards, citing a string of breaches in which identity documents and sensitive customer data had been stolen and could now be exploited to create fraudulent accounts. “In recent years, there have been a series of unauthorised access incidents in various industries, resulting in numerous cyber incidents in which customer information, including images of identity verification documents, has been leaked,” Katayama said.
Recent disclosures show how broad the disruption has been. Major breaches at Times Car Rental and convenience-store chain Lawson exposed approximately 6.6 million and 2.15 million customer records respectively. Rail operators, car manufacturers, karaoke chains and police authorities have also been hit, with the Financial Times reporting more than 20 large Japanese companies disclosing attacks in recent weeks alone. Research by Japanese IT firm Macnica found that Japan had suffered 119 cyber attacks in 2026 as of October 6, with 68% occurring since July, a sharp acceleration from the 86 attacks recorded throughout 2025.
Authorities say artificial intelligence is intensifying the threat. Japan’s Computer Emergency Response Team Coordination Center (JPCERT) found evidence that attackers are using AI tools to scan automatically for known vulnerabilities and probe application programming interfaces. Japanese security firm GMO Cybersecurity additionally alleged that a Chinese-developed AI tool had been deployed in some of the attacks.
The FSA is not acting alone. Japan’s National Cybersecurity Office issued parallel guidance to ministries, local authorities and private-sector companies, instructing them to update security software, enforce strong password policies and harden supply-chain security. The Ministry of Internal Affairs and Communications issued its own equivalent instructions to organisations under its remit.
At an emergency meeting of the National Cybersecurity Strategy Headquarters, former digital minister Masaaki Taira described the situation as “a state of emergency in cyberspace”. The ruling Liberal Democratic Party is understood to be drafting a broader emergency policy package in response.
Copy link