Japan’s latest ransomware surge has turned a long-running cyber-security concern into a visible national disruption. In recent weeks, hackers have tampered with servers, knocked local-government websites offline and accessed large stores of consumer data. Masaaki Taira, a former digital minister who leads the ruling Liberal Democratic Party’s cybersecurity committee, called it “a state of emergency in cyberspace.”¹

The scale is stark. TrendAI recorded 600 reported cyberattacks in Japan during the first nine months of 2026—more than in all of 2025. Over the past two weeks, a public university cancelled classes for a week after an attack; a car-sharing business reported the leak of more than one million personal documents, including licence photos and home addresses; and a ransomware hit on a SoftBank-owned cloud operator disrupted nearly 500 companies and local governments, including a rail operator and police headquarters.¹

For authorities, the immediate task is containment: restore services, protect personal data and strengthen defenses across sectors. But experts caution against treating the episode chiefly as a geopolitical campaign. Their assessment is that the attackers are probably chasing ransom payments or stolen data they can sell—an economically rational assault on systems that have been left exposed.¹

AI sharpens that threat rather than creating it from scratch. Automated tools can probe websites around the clock for vulnerabilities, while AI-generated Japanese translation can make phishing messages more persuasive. Katsunari Yoshioka, a systems-security professor at Yokohama National University, warned that such attacks can cause “the suspension or degradation of systems and services that are important to society.”¹

The clash, then, is not over whether Japan faces a crisis, but what it reveals: government alarm reflects the breadth of the disruption, while specialists see a costly backlog of unpatched infrastructure—one that AI-equipped criminals can now exploit at greater speed.¹