Japan's Autumn 2026 Breach Wave — Intrusions from a Cloud to a Mailer, a Retailer and a Carrier

In the autumn of 2026 Japanese companies disclosed one large intrusion after another. They were not one attack: a cloud provider was hit by ransomware, a bulk-email service had its customers' mailing lists carried off and its own servers used to send phishing, an online retailer found a suspicious file on an outside cloud service, and a mobile carrier shut its online shop. What linked them was timing, and the government's reading of the pattern. On 5 November the National Cybersecurity Office told businesses that many of these cases came down to basic measures not being in place, and that the attackers were also likely using AI to research targets and break in.

The Four Incidents

IDC Frontier: Ransomware Against a Cloud

At about 3:40 a.m. on 7 October, customers in part of IDCF Cloud's East Japan Region 1 found that their virtual servers had stopped and would not restart. IDC Frontier, a SoftBank group data-centre and cloud company, set up an emergency headquarters at 9 a.m. that day, shut down the IDCF Cloud portal and cut off the storage equipment of the four affected zones (tesla, henry, pascal and joule), then took the portal offline in every other region too.

Its seventh report, issued on 27 October after the investigation was complete, laid out the path. The attacker exploited a vulnerability in open-source software used by the authentication system of the IDCF Cloud portal, the site customers use to start servers and check bills. From there it obtained administrator rights over the virtualisation platform through the management console, stopped customers' virtual servers and encrypted the servers themselves. The report does not name the software.

IDC Frontier says the data inside the encrypted virtual servers did not leave them: it found no traces of data being carried out and nothing supporting that, a conclusion first announced in its fifth report on 14 October. What did happen was smaller. In the portal, registration data for up to 71 customers was improperly queried, up from 48 in the fifth report; up to 31 of those entries included personal names or email addresses that might contain them, and up to four customers' login passwords had been changed. It found no sign of that data being taken out either. The company said it had not contacted the attacker and had neither paid nor negotiated a ransom. Backups could be retrieved for 206 customers who had used the snapshot feature, up from 194; for the rest, the company is helping move systems to replacement environments with its parent SoftBank.

Arara: The Mailer Behind the Mail

Arara Message is a bulk-email delivery service that companies use to send newsletters and notices to their own customers. Its operator, Arara, published three reports. The first, on 29 October, spoke of about 3.01 million email addresses taken from one shared environment through a web-server vulnerability. By the second, on 2 November, the picture had widened: an attacker who got into one of the service's servers had used it, from 28 to 31 October, to break into many more and carry off the contents of their databases. Those 97 servers held the address books of client companies, with fields that varied by client (name, sex, date of birth, phone number, membership number, address). Arara stopped the entire service on 31 October, completing the shutdown at 19:53, and has not set a date to restart.

The third report, on 6 November, added 3,249,492 addresses taken from a second cloud environment during the same window, and removed duplicates across categories to reach the 81,329,467 total. The service was also used against the public. From 28 to 30 October, two environments sent up to about 7.13 million suspicious emails impersonating credit card companies, from the address news@arara.com, to recipient lists the attacker had brought in from outside. Arara reported the case to the Personal Information Protection Commission and the police on 29 October and to the Kanto Bureau of Telecommunications of the Ministry of Internal Affairs and Communications on 4 November.

Iris Plaza and Docomo

Iris Ohyama runs the online store Iris Plaza. According to Business+IT, a suspicious file was found on an outside cloud service on 28 October and the store and related systems were shut down that day; the police and the Personal Information Protection Commission were notified on 29 October. The second report, on 5 November, said personal data on up to about 7.7 million people may have leaked: about 5.8 million members, including former members, and about 1.9 million non-members who had bought without registering or entered campaigns. Member records included name, address, phone number, email, sex, date of birth and an encrypted password; card data was not stored on that cloud service.

NTT Docomo said it confirmed unauthorised access from outside to Docomo Online Shop and My docomo on 4 November and suspended procedures on both from about 1:05 a.m. on 5 November. Its second notice that evening said up to about 300,000 records had leaked, including names, addresses, dates of birth, mobile numbers and contact numbers. The cause and the route in were still under investigation, and no restart date had been set.

The Government's Reading

The National Cybersecurity Office convened an emergency meeting of ministries on 8 October, attended by 29 organisations, and on 9 October issued an advisory to businesses handling large amounts of personal data: manage web systems properly, guard against compromise through the supply chain, and manage data carefully, telling executives the problem was no longer one for the IT department alone.

On 5 November it went further. Its advisory said the government had confirmed several leak cases that appeared to stem from basic gaps at the victims or their contractors: weak security in mobile-app development, misconfigured websites, and software that was out of support or left unpatched against known flaws. Attackers, it said, appeared to have surveyed Japanese websites on a large scale and broken into those where a way in turned up, and it was highly likely they were using AI for that research and intrusion; risks that earlier assessments had rated relatively low could combine into a way in. Because attacks were easier to scale, businesses of every size were now targets. The document asks operators to track their software components (including through SBOMs), prioritise vulnerabilities known to be exploited, shrink their internet-facing attack surface, secure the APIs behind their apps, and consider AI for their own defence.

The advisory names no company, and none of the four firms above has linked its case to the others. The same autumn, security vendors documented agentic AI attack frameworks running many intrusions in parallel. Like the Danish CPR breach earlier in October, the Japanese cases ran less through exotic exploits than through the ordinary plumbing that sits between a company and its customers.