Companies Quietly Leave a Country That Won't Hit Back: Japan's Active Cyber Defense Explained

Hello, this is Ryuta Hamamoto from TIMEWELL.

On 24 October 2026, GMO Internet announced that it had "asked the government to apply active cyber defense." Cloud servers used for automated FX trading had been accessed without authorization, and trades the account holders did not recognize were made. The servers that may have been affected number 26,739. The company has said it intends to compensate for losses¹.

What interests me is what happened next. The new system, which had only started running on 1 October, was not built to answer that request. There is simply no procedure for a company to ask the state to invoke it¹.

A company that has been attacked is buried in recovery, compensation, reporting and explanations. The attacker, in most cases, faces nothing at all. If that imbalance continues, how will companies behave? My view is that some will quietly start choosing again which country their data and systems sit in.

I wrote this article so that you can follow it without being a cybersecurity specialist. I explain each technical term as it appears.

Key points

• On 1 October 2026, Japan started running the core of its active cyber defense. But what the state can stop is mainly the attacker's "relay points," not the attacker
• A company that is attacked carries two burdens at once: the loss itself, and the duty to report and explain. The price paid by the attacker stays small
• If companies begin placing data in countries that actually protect them, computing resources, technology, talent and investment follow in that order. Once that starts, it is hard to reverse
• That said, there is no evidence that a large outflow is already under way. The claim here is not a report of facts. It is a warning that, left alone, forces will push in that direction
• For government, the first steps are to show that the tools are actually used and to give something back to companies that report. For companies, they are to design for recovery and to choose deliberately where data sits

Three terms to get straight first

Term	In plain words
Ransomware	An attack that encrypts a company's data so it cannot be used, then demands money to restore it
Relay point (stepping-stone machine)	Someone else's server, router or camera that an attacker has taken over and uses to relay an attack
Neutralization	Stopping the attack function of a machine that is being used as a relay point. It does not mean storming the culprit's base

What Japan decided, and what it can now do

Major damage that began in autumn 2025

Let me first go over what has happened recently.

On 29 September 2025, Asahi Group Holdings was hit by ransomware. Ordering and shipping were paralyzed for about two months, and at the end of October the items it could ship were reported to have fallen to about 10% of normal. Shipping of the full product range resumed about six months later, in April 2026².

On 19 October 2025, Askul detected ransomware and halted orders and shipping for its main services. Sales for the June to November 2025 period fell 12.3% from a year earlier, and operating results swung from a profit of about ¥6 billion to a loss of about ¥3 billion. For the interim period it booked ¥5.2 billion as an extraordinary loss for the response to the system failure³.

Then came GMO Internet in October 2026. What the three cases share is that the size of the damage was set by how long recovery took.

The three pillars of the system

Against this background, Japan enacted the Cyber Response Capability Enhancement Act and its implementing amendments in May 2025. The parts that began on 1 October 2026 are laid out as follows in a Cabinet Secretariat document¹.

Pillar	Content	In force
Stronger public-private cooperation	258 operators in 15 critical infrastructure sectors, such as electric power and finance, must register their assets and report incidents. A council for sharing information between government and industry is set up	1 October 2026
Access and neutralization measures	The police or the Self-Defense Forces remotely access servers and other machines used in attacks and, where necessary, stop the attack	1 October 2026
Use of communications information	Analyze communications that involve other countries in order to find attack servers	Autumn 2027

It has been about four years since the 2022 National Security Strategy set the direction. As a system, this is a real step forward.

What can be stopped is the relay point, not the attacker

This is the point most people misunderstand. When they hear "neutralization," many picture a counterstrike on the attacker's base. That is not what it is.

Suppose a thief uses a stranger's telephone to make threatening calls. Neutralization is closer to pulling out that phone line. It is not breaking into the house of the person making the calls. In practice it means deleting malicious programs from a hijacked router or server, shutting the machine down, or changing settings so the attacker cannot log in again.

Attackers stack relay points several layers deep to hide who they are. According to the Cabinet Secretariat, 99.4% of the packets containing attack traffic that the National Police Agency observed in 2024 came from IP addresses abroad⁴. Stop one link in the chain and the attacker simply finds another relay.

On top of that, "use of communications information," the part that looks for the source of an attack, does not start until autumn 2027¹. The hand that stops attacks has been prepared before the eyes that locate the attacking infrastructure are fully in place.

The activation procedure is also careful. As a rule, prior approval is required from the Cyber Communications Information Supervisory Commission, a third-party body. The government says it has been running repeated drills across ministries, practicing the approval application and related steps¹. The design is meant to avoid misfires and abuse of authority, and I think that caution is right in itself.

It is not a system for getting damage back

There is one more thing to keep in mind. The purpose of neutralization is to prevent damage from spreading in the future. Getting stolen information back or covering a loss in someone's account is not part of its aim.

The government's cautious reaction to GMO's request is what the design would predict. Press reports summarize it this way: the government decides whether defense is needed, and the system is not built to act on a company's request⁵.

Afterward, at a meeting of ministers on 26 October, Prime Minister Sanae Takaichi said that for attacks whose reality the government has grasped, it would strategically choose and carry out the options available, including neutralization. She also instructed that the attacking party be identified together with allies and like-minded countries. For victim companies, she put forward an expanded set of consultation desks and a framework for using private-sector experts from first response through recovery. The government says it will put together an "emergency countermeasures package" within the following week⁶. As I write this on 5 November, I have not been able to confirm its final contents.

The direction is right, I think. What matters is whether it is carried out continuously, in a form that companies can see.

There are two kinds of deterrence

In security studies, deterrence is split in two.

• Deterrence by denial makes an attacker believe the attack will not succeed. Strong defenses and the ability to recover quickly belong here
• Deterrence by punishment makes an attacker believe the attack will bring pain. Attribution, public disclosure, indictment, sanctions and asset freezes belong here

For a long time, Japan's cyber policy has relied almost entirely on deterrence by denial. And the ones doing the defending were not the state but individual companies. Neutralization is a step in which the state gets its own hands dirty, but as long as it stops at shutting down relay points, it remains an extension of denial. To make attackers feel that "targeting Japan is expensive," the country has to keep up attribution, public disclosure, indictments and sanctions, together with its allies. The government's own materials list takedowns (stopping attack infrastructure) and "public attribution," naming the attacking party in public, as examples of responses¹.

Only the company that was attacked pays twice

The first burden is the loss from the attack itself

Society does not blame a shop that has been robbed. The police chase the criminal and the courts judge. With cyberattacks, though, the company that suffered the damage is often asked why it could not prevent it.

Take Askul. Its distribution centers are highly automated, and if the control systems stop, all shipping stops. According to the published report, even the online backups were encrypted, which was one factor that prolonged recovery. The report also cites the lack of offline backups, disconnected from the network, as part of the background to the damage spreading⁷.

What I want to point out is that this is not a story about negligence. Askul published its findings and its recurrence-prevention measures itself, because they would be a lesson for whoever stands in the same position next. I don't think the right response is to blame a company that discloses. The most useful way to read a disclosure like this is to hold it against your own company.

The second burden is the duties that arrive afterward

After an incident, the next tasks all come at once.

• Reports to the supervising ministry and to the Personal Information Protection Commission
• Notifying people whose data may have leaked, and handling their inquiries
• An investigation by an outside specialist, and publication of the results
• Explanations to business partners and, in some cases, compensation
• Explanations to shareholders and investors
• Press conferences and continuing progress reports

Every one of these is a legitimate demand. A company that hides information should not be excused, and notifying victims is a plain duty.

The problem is that the whole burden gathers on the victim company for one reason only: it was attacked. Since October 2026, the law requires critical infrastructure operators to report incidents¹. What was reported can later be used as evidence of "how much the company knew" in damages claims and shareholder derivative suits. A safe harbor, a mechanism that softens the disadvantage to a company that reports honestly, is not yet adequately in place.

Japan's personal information law was also amended, with the amending act passed on 10 July 2026, and it introduced an administrative surcharge for the first time⁸. But a surcharge looks at the profit gained from a violation, and it covers only a narrow set of types of conduct. As far as I could confirm, it does not charge the mere fact that data leaked after an attack. So it is not accurate to say that we have entered an era of fining companies for being attacked. Still, the fact that the surcharge tool is now in the system carries weight. In Europe, the EU's NIS2 Directive sets penalties for essential entities that breach management or reporting duties at up to EUR 10 million or 2% of worldwide turnover, whichever is higher⁹. Japan's debate may move closer to that.

The attacker's cost stays low

What about the side that attacked?

We hear almost nothing about attackers in cases aimed at Japanese companies being identified, indicted and having their assets seized. Most of them are in countries that Japanese investigators cannot reach.

In economists' terms, there is an asymmetry here. The attacker keeps the gain from the attack, and the victim company pays its cost. Making the attacker pay is a role that, in the end, only a state can play. As long as that role goes unfilled, companies stay in the position of defending forever, however much they invest in defense.

Generative AI is making the situation harder. Finding vulnerabilities (weaknesses in a system), writing attack programs and drafting phishing emails tailored to each target are all getting cheaper fast. Attacks will increase, and their quality will go up.

It is heavier still for small businesses

Much of the damage falls on small and medium-sized businesses. According to the National Police Agency, reports of ransomware damage in the first half of 2026 numbered 123, the highest ever for a half-year. Of these, 79 involved small and medium-sized businesses, about 64%¹⁰.

For a small company, which often has no dedicated staff, no budget for an investigation firm and no PR department to run a press conference, an attack can threaten the survival of the business. Small companies are also targeted through their large customers. A poorly defended supplier is a way in to the real target. The company used as the entrance is blamed, the customer demands stronger controls, and if it cannot comply, the relationship is reviewed. The burden of defense is pushed down the supply chain.

What happens if companies choose a country again

What "choosing a country" means

There are broadly three ways for a company to reduce cyber risk. Invest in its own defenses. Transfer the risk through insurance. And choose under which country's law and power it places its data and systems. The discussion so far has concentrated on the first two. The third is already in companies' hands.

"Moving data abroad" may sound extreme. In practice it is a pile of plainer decisions.

• Which cloud provider, and in which country's region (the physical location of the data center), to put the core systems
• Whether key intellectual property such as design data is managed by the Japanese head office or an overseas subsidiary
• Which country's governing law and courts to choose in contracts and disputes
• In which country's market to place cyber insurance

Each is decided by weighing cost, regulation, talent and distance from customers. What if one more yardstick joins them: "when we are attacked, what will that country's authorities do for us?" That is the question of this article.

Placing data in Japan is not required across the board by law or certification. For example, on ISMAP, the government's cloud evaluation scheme, I searched the full text of the control criteria and wrote up the results in a separate column.

Rational decisions add up and change the shape of a country

Let me use a hypothetical example. Take a manufacturing company that does business with overseas customers and holds design data and manufacturing know-how. It has watched, year after year, the news of competitors whose factories were stopped by ransomware.

For that company's executives, "entrusting the storage and operation of key data to a provider in a country that actually prosecutes attackers" is not a betrayal. It is sensible risk management, part of their responsibility to shareholders. And the decision is never announced. It is made quietly, to coincide with a system refresh.

What is rational for each company can produce an unwelcome result for society as a whole. Economists call this the fallacy of composition. It is like a cinema where the person in front stands up, so the person behind has to stand, and in the end everyone is standing and nobody sees any better. If one company puts its key data abroad, Japan's security barely changes. But if many companies make the same decision for the same reason, the total of what stays in Japan shrinks, and the state's motive and ability to protect weaken.

There are cases where a state has visibly shown that it defends. In February 2024, Operation Cronos, an international operation led by the UK's National Crime Agency and the US Federal Bureau of Investigation, took control of the infrastructure of the ransomware group LockBit and obtained more than 1,000 decryption keys, which were used to help victims. Arrests, indictments and asset freezes were combined with it¹¹.

Let me add one thing here. Protection from another country is not guaranteed. The authorities of another country protect their own companies and citizens first. If Japanese companies move anyway, it will be because their expectations of what they would get by staying in Japan feel even lower.

Business partners, investors and insurers may push the sorting (the author's view)

It is not only the company that decides where data sits. What follows is my own reading.

If you do business with large overseas manufacturers or defense-related companies, your customers will ask for a certain level of security. If the shortest route to meeting that level is to run on the platform of an overseas provider already familiar with the requirements, companies will take it. A day may come when institutional investors, when assessing the cyber risk of the companies they hold, include how far the authorities will act during an attack. Insurers may also change premiums and terms depending on where data is kept.

So before companies choose a country again on their own, their business partners, investors and insurers may make them choose again.

The outflow chains

I believe that once data starts moving abroad, the movement does not end with data.

1. Data. The storage and processing of design information, customer information and operating data move abroad
2. Computing resources. It is efficient to process data where it sits, so demand for data centers and AI computing infrastructure moves abroad as well
3. Technology. The experience of designing and running large systems builds up at overseas providers
4. Talent. Engineers gather where they can gain that experience
5. Investment. Capital goes where talent and technology gather

In the age of generative AI, data is the raw material that decides a product's competitiveness. A manufacturer's operating data, its drawings, its inspection records. Data that is unique to Japanese companies shapes how well an AI trained on it performs. Even if a Japanese company legally owns the data, which country's authorities can demand access to it, and which country's law prevails in a dispute, changes with where it is stored.

A data center takes years to build. If demand moves abroad, the reason to build at home weakens, and once a place is built, providers and talent gather there. Most cyber defense technology comes only from experience of running large systems and dealing with real attacks. If that experience piles up abroad, what Japanese engineers get to touch is limited to the settings in an admin console and the support desk for outages.

There are already signs in the numbers. According to the White Paper on Information and Communications from the Ministry of Internal Affairs and Communications, the combined balance of three categories, computer services, royalties and licensing fees, and professional and management consulting, was a deficit of about ¥6.7 trillion in 2024, and payments again exceeded receipts, by about ¥6.6 trillion, in 2025¹². These categories include non-digital services as well. The deficit is also the flip side of sales and jobs that would otherwise have landed in Japan. But the widening deficit is mainly explained by the competitiveness of overseas services, and it does not show that differences in cyber defense are the cause.

A country that does not grow a defense industry

The cybersecurity industry grows partly because the state is its first customer. In the United States and Israel, defense and intelligence agencies needed advanced technology and spent large budgets on it, and engineers who gained experience there went on to found companies.

What often gets overlooked is that offense and defense are two sides of one coin. Without a deep understanding of how attackers get in and how they cover their tracks, you cannot build a product that detects them. If the state does not act actively against attackers, domestic demand for this kind of technology is slow to appear, and neither companies nor engineers' careers have much to grow on.

Most of the security products Japanese companies use are already made abroad. A product reaches deep into the systems where it is installed, and the vendor also decides what counts as an attack. There is no guarantee that, in an emergency, that judgment will line up with Japan's interests.

That is why I see active cyber defense as industrial policy as well as security policy. If analysis platforms, threat intelligence and device-analysis technology are bought continuously from domestic companies and research institutions, that creates demand for the domestic industry. If everything depends on foreign products, the system may run, but no technology stays in Japan.

Japan also has strengths. One is the manufacturing floor: equipment that must not be stopped, machines used for decades, proprietary communication methods. Defending the control systems of factories and critical infrastructure is a field where Japan can build a lead ahead of the world. The other is the Japanese language and Japanese business practice. Many attacks on Japanese companies exploit Japanese-language messages and work procedures. There is a lot of room for domestic providers to cover what foreign products miss. To turn strengths into an industry, the state needs to be a first customer and give them chances to try things in the field.

Why what leaves is hard to bring back

If what left came back as business cycles turn, there would be little to worry about. There are at least four reasons it does not.

The first is the cost of moving. Changing where a core system sits is a multi-year undertaking, and for most companies it is a decision made once a decade at best. If things run without trouble in the new place, an improvement in Japan's defenses is hardly a reason to spend a large sum going back.

The second is that the surrounding arrangements get rebuilt around the new place. Operations staff and contractors, monitoring, audit, insurance and data links with business partners are all reassembled.

The third is the accumulation of talent and technology. The experience of running a large system and dealing with a real attack cannot be bought back quickly with money.

The fourth is that the motive to defend weakens. If most important things are abroad, the political reason to spend budget on strengthening domestic defenses weakens too. Once the sense spreads that "the important things are in an overseas cloud anyway," defense investment gets pushed back.

Japan has been through something like this once. It was the move of manufacturing overseas from the late 1980s to the 2000s. Even after the yen weakened, most of the factories that had moved did not return. A factory closure hits local jobs directly and makes the news, but when data changes location, nobody holds a press conference. That is exactly why it may be too late by the time anyone notices.

There is also a rough timetable. Companies' core systems are typically overhauled every five to ten years. Many companies are now moving to the cloud and rebuilding operations around AI. The location chosen in this refresh will likely stay until the next one. In other words, what Japan shows over the next few years will shape the placement for the following ten. Autumn 2027, when the use of communications information begins, falls right in that window.

How far is this argument right?

There are strong counterarguments to the line of reasoning so far. To make my claim stronger, I will take them head on.

Objection 1: "Attacks don't stop just because you move abroad." That is correct. In the United States too, a major oil pipeline operator and a large medical payments company suffered serious ransomware damage. LockBit stood up new bases within days of having its infrastructure seized. But my claim is not that moving abroad makes you safe. It is that an incentive arises for companies to decide so. A company's decision depends not only on actual safety but also on what it expects will happen, and who will act, when it is hit.

Objection 2: "The destination country won't necessarily protect Japanese companies." This is also an important point, and it reinforces my conclusion. If companies move even without full protection, it is because their expectations of staying in Japan are lower still. And a company that has moved puts its safety in the hands of another country's interests. That is what losing digital sovereignty means.

Objection 3: "Striking back brings misfires and escalation." Identifying an attacker is hard, and disguises exist. Acting against the wrong party breaks a bystander's machines. That is why Japan's system includes strict procedures such as prior approval. I do not think the procedures should be dropped. What I am asking for is that, with the procedures observed, the tools actually be used and the results shown.

Objection 4: "Confidentiality of communications and the expansion of government power." Authority for the state to analyze communications and remotely access other people's machines is in tension with civil liberties. Raising the state's capability and protecting freedom is not a choice of one over the other. It is a problem that calls for a design that satisfies both.

Objection 5: "The reporting duty exists for society's defense as a whole, not as a punishment." I agree with the intent. But from a company's point of view, what matters is whether the return on reporting is visible. If a report led to the attacker being caught, or the same technique stopped, that would show. Without such results, reporting feels like a one-sided burden.

Objection 6 is the most fundamental. "Is there evidence that companies are actually moving data because of which country strikes back?" At this point I can find no systematic data showing that. The reasons companies choose where to put data are mainly performance, price, regulatory fit and talent. On the other side, policies that encourage keeping data at home for economic security reasons, and the build-out of cloud platforms for government use, are also moving forward.

So this article is not a report that a large outflow has already happened. It is a warning that, if the structure of today's incentives is left alone, a force will keep acting in that direction. How strong that force is remains to be tested. But for a change that cannot be undone, I also feel that waiting until the evidence is in would be too late.

Most of these objections are cautions about how to strike back. They do not lead to the conclusion that striking back is unnecessary. Misfires can be contained by strict procedure. Civil liberties can be protected by independent oversight. The reporting duty can be turned from a burden into cooperation by showing what companies get in return. The danger of not striking back, on the other hand, cannot be contained by procedure.

What government and companies can do

There is one aim behind all of this: to move the party that pays the cost of an attack from the victim company back to the attacker.

What I would like to see from government

1. Make active cyber defense a system that is used. While protecting what must stay secret, I would like the numbers, outlines and effects to be shown, for example in reports to the Diet by the Supervisory Commission. A power that is never used does not exist, as far as an attacker is concerned
2. Keep up attribution and public disclosure, together with allies. Pair publicly named parties with indictments, sanctions and asset freezes
3. Start the use of communications information on schedule, with oversight that works. Without eyes to find the source of attacks, the hand that stops them cannot work well enough
4. Make reporting rewarding for companies. Return to them how their reports helped others' defenses, and consider a safe harbor that softens the legal disadvantage of a company that reported honestly
5. Revisit where the line is drawn. As in GMO's case, there are incidents where damage spreads widely across citizens' assets even though the company is not critical infrastructure under the law. The state should be able to get involved in proportion to how far the damage extends
6. Grow the domestic defense industry from the demand side. Be a first customer and keep placing orders

What companies can do

There is a lot you can do while waiting for the state to act. And it also keeps open options other than moving offshore.

• Design for recovery. A backup in the same place can be encrypted along with everything else. Prepare backups disconnected from the network, and a procedure that lets you run minimum operations by hand
• Choose deliberately where data sits. Classify it by importance, and decide what stays in Japan and what may go abroad. Do not leave it to default settings. The overall way of thinking is in an AI security strategy that protects data sovereignty
• Use and grow domestic technology. Choosing a domestic provider when performance is comparable is the most direct way to keep experience and talent in Japan
• Share information with the state. Whether or not a reporting duty applies to you, share information about attacks with the authorities and industry bodies. The material for identifying attackers sits with the victim company
• Know your contacts before an incident. IPA and police consultation desks, and the Cybersecurity Otasuketai Service for small businesses, are the main ones

For what to do right after an incident, see what to do in the first hours after a breach. For small-business priorities, see the PC and endpoint checklist. If you want to check your own readiness quickly, the AI literacy check can also help.

Priorities for the first few years

You can't do everything at once. This is the order I would use.

First, build a first track record. Show society, within what can be disclosed, cases where active cyber defense was actually used and worked. The first case tells companies and attackers alike that the system is not decoration. Second, build a cycle of reporting and return. Now that reporting has started, analyze the information collected quickly and send it back in a form that helps other operators. Third, invest continuously in domestic technology and talent. Results take time, so the sooner it starts the better.

These three support one another. A track record encourages reporting, reports become material for analysis, analysis sharpens domestic technology, and sharper technology produces the next track record. I think this cycle is what can stop the chain of outflow.

Closing

The damage from a cyberattack is usually told in money. For Askul, it is the drop in sales and the ¥5.2 billion extraordinary loss. For GMO, it is the funds lost from users' accounts and the cost of compensation.

But I think the real cost of not striking back lies elsewhere. It is that companies stop trusting their country. An attack comes, and the state does nothing to the attacker. Worse, the victim company is left with a growing pile of reporting and explanation duties. A company that feels this may quietly move its data to a country it can lean on more.

In October 2026, Japan gained a new tool in active cyber defense. It came after a long debate and is a big step. But a tool only means something once it is used. Can Japan build a record of identifying attackers, taking down their infrastructure and, with allies, making them pay, while keeping its procedures legitimate? The next few years will decide it, I think.

Once, companies could not choose their country. Now a single setting in a cloud console decides which country holds your data. Before companies choose again, can the state show its will and its power to protect them? The answer will shape the very reasons to keep data, technology and talent in this country.

Take this article as a prompt to write on one sheet of paper where your company's data is, and who you would contact, and about what, on the day you are hit. If you are unsure how to set up recovery procedures or internal rules, our WARP SECURITY is also an option. It is a training program that spends its time on everyday preparation, such as internal approvals and judgment calls at the moment of discovery, rather than on explaining attack techniques. You can reach us through a consultation request.

References

The facts are based on published materials and press reports as of 5 November 2026. As far as I could confirm, the final contents of the emergency countermeasures package and the cause of the GMO Internet incident are not yet settled.

Footnotes

1. On the Enforcement of the Cyber Response Capability Enhancement Act and Related Laws — Cabinet Secretariat National Cyber Office and Cabinet Office — September 2026 (Japanese). For GMO Internet's announcement (24 October 2026) and the government's reaction, I referred to Impress Watch's report (Japanese) ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

2. Asahi Outage Caused by Ransomware — Akita Sakigake Shimpo — 3 October 2025 (Japanese), Asahi Outage One Month On, No Prospect of Recovery — Akita Sakigake Shimpo — 29 October 2025 (Japanese), Timeline of the Asahi Cyberattack — an explainer compiling general press reports (Japanese) ↩

3. What Was the Impact of the Ransomware Attack on Askul? — Netshop Tantosha Forum — 29 January 2026 (Japanese). The extraordinary loss is reported as ¥5.2 billion for the interim period (June to November 2025) and ¥5.1 billion for the full year ↩

4. Reference material on cyber security initiatives from the Cabinet Secretariat, citing National Police Agency observation data (Japanese). It notes that, of the packets containing attack traffic directed at darknet addresses, 99.4% originated from IP addresses abroad ↩

5. GMO Asks for Active Cyber Defense to Be Applied — Impress Watch and other press reports, compiled — October 2026 (Japanese) ↩

6. Ministerial Meeting on Cybersecurity (1st) — Prime Minister's Office — 26 October 2026 (Japanese), Government to Draw Up an "Emergency Countermeasures Package" Against Cyberattacks Within the Week — ITmedia NEWS — 27 October 2026 (Japanese) ↩

7. Press report on Askul's published report on the ransomware investigation results and recurrence prevention measures — Business+IT — 12 December 2025 (Japanese) ↩

8. Act to Partially Amend the Act on the Protection of Personal Information Promulgated — ScanNetSecurity — 29 July 2026 (Japanese). Enacted on 10 July 2026 and promulgated on 17 July. For details of the conduct subject to the surcharge, please check the Personal Information Protection Commission's published materials ↩

9. Directive (EU) 2022/2555 (NIS2) Article 34 — EUR-Lex ↩

10. Threat Situation in Cyberspace in the First Half of Reiwa 8 (2026) — National Police Agency — September 2026 (Japanese). The share of small and medium-sized businesses is my own calculation from the number of reports ↩

11. LockBit: How an international operation seized control of the world's most harmful cybercrime group — World Economic Forum — February 2024. The number of decryption keys is "more than 1,000" as of the February 2024 announcement ↩

12. White Paper on Information and Communications, Reiwa 8 (2026) edition, ICT Exports and Imports — Ministry of Internal Affairs and Communications (Japanese), White Paper on Information and Communications, Reiwa 7 (2025) edition, Trends in the Services Balance of Digital-Related Items — Ministry of Internal Affairs and Communications (Japanese) ↩