Japan is now treating a run of cyberattacks as something close to a state of emergency in cyberspace. Police figures show that at least 53 organizations in the country have fallen to ransomware, a major rail operator says more than 6 million customer records may be exposed, and a breach at a car rental brand has prompted the financial regulator to rethink how banks confirm who their customers are. In neighboring South Korea, banks and churches have been hit by attacks that the security company CrowdStrike attributes to an AI agent developed in China using Anthropic’s Claude Code. AI agents are programs that take a goal and carry out the steps on their own. The broader lesson is uncomfortable: security that was good enough yesterday may not hold today.
A crisis the government now admits
The tone of the coverage shows how serious things have become. Gizmodo ran a headline saying Japan had warned the world that it had entered a “cybersecurity hellscape.” The Financial Times described a country under heavy, coordinated attack across many industries. Japan’s financial regulators are racing to work out how to keep financial institutions from suffering a catastrophic breakdown in their operations.
The scale of the damage pushed officials to formally acknowledge a cyber crisis. The ruling Liberal Democratic Party called an emergency meeting with the National Cybersecurity Office to work out a defense against an unprecedented surge in attacks.
This is not yet a full-blown cyber apocalypse brought on by AI. Still, the attacks appear to be edging dangerously close to catastrophe on a national scale.
The victims so far
Kyodo News, drawing on data from Japan’s National Police Agency, reported that ransomware has struck at least 53 organizations inside the country. Ransomware is malicious software that locks up or steals an organization’s data and then demands payment. The victims are not confined to one corner of the economy. They include manufacturers, construction companies, schools and hospitals, the kinds of services a society depends on every day.
Several companies caught up in the crisis are known by name:
| Company | Business | What is known |
|---|---|---|
| Bookoff Group | Secondhand goods retail | Confirmed that attackers got into its systems |
| East Japan Railway Company | Railway | Admitted an intrusion that may have exposed over 6 million customer records |
| Times Car | Car rental | Hacked, with a large store of customer driver’s license images taken |
Authorities are keeping the full list of breached organizations private while investigations continue, so only a handful of names are known.
How a rental car breach reached the banks
The Times Car incident shows how damage at one company can spill into an entirely different industry. After a large collection of customer license images was taken from the company, Japan’s Financial Services Agency advised banks to stop treating a driver’s license on its own as proof of identity when someone opens a new account. In practice, that means adding a second verification method on top of the license after a leak of this size.
The reasoning appears simple. When copies of the same license circulate in bulk, the card by itself can no longer prove that the person presenting it is its owner. A service that collects and stores ID scans may, in effect, be holding part of other organizations’ identity checks, and a breach there can weaken those checks well beyond its own walls.
▲ Leaked ID scans and stricter identity checks
Old systems and thin budgets
Why has Japan been hit so hard? One analysis from a cybersecurity news outlet pointed to structural weaknesses in the country’s overall cyber resilience:
- Outdated technology: Many organizations still depend on aging legacy IT systems, and that dependence is described as the main source of the country’s exposure.
- Chronic underinvestment: Spending on basic cyber defenses has lagged for years.
- Exposed infrastructure: The result is critical infrastructure left open to attack.
The AI agent tied to attacks in South Korea
Japan is not facing this alone. Reuters reported that several South Korean banks and churches were struck in coordinated attacks.
CrowdStrike linked those campaigns to an AI agent developed in China. According to its findings, the agent relied on Anthropic’s Claude Code.
▲ AI agents lowering the bar for attackers
That matters because generative AI cuts the skill needed to run an attack. Tasks that once required experienced operators can be handed to software that automates the work and repeats it at scale. As the bar drops, the balance between attackers and defenders seems to be shifting in the attackers’ favor.
There is no hard evidence yet that AI agents carried out any of Japan’s 53 ransomware cases. A connection looks very likely, though, and it would hardly come as a surprise if one were confirmed.
What organizations should do now
Japan’s experience shows how vulnerable organizations running aging systems on thin security budgets are to ransomware and the theft of identity documents. The South Korean campaigns suggest that automated, AI-assisted attacks are already operating in the real world, and they look like the direction cyber threats are heading. Settings and procedures that seemed adequate until recently may already fall short against automated attack tools.
Three steps follow directly from that:
- Review every internet-facing system now. Audit the servers, devices and network edges that outsiders can reach, and strengthen them without waiting for an incident.
- Retire outdated IT and fund modern defenses. Replace legacy systems and increase spending on modern cyber defenses.
- Do not let one ID document carry identity checks. Banks and other services that verify new customers should add a second check beyond a driver’s license, especially after a large leak of ID images.
With similar attacks already reaching South Korea, the warning appears to apply well beyond Japan.