Japan’s government announced a 10 billion yen (US$63 million) emergency cybersecurity package on November 6, 2026, after dozens of companies and government agencies suffered unauthorised access to their systems and leaks of client data, raising immediate questions about whether existing corporate cyber programmes reflect the scale of risk now documented.
Prime Minister Sanae Takaichi announced the measures at a ministerial meeting, describing the response as a collective effort across all government ministries. “At this very moment, cases of unauthorized access and data breaches are occurring, causing a major impact on daily lives of the people and corporate activities. Let us increase the response capability across Japan by devoting all government resources,” she said.
The package, funded from fiscal 2026 budget reserves, is built around four pillars: AI-based security measures, strengthened intelligence gathering, strategic attack response, and enhanced victim support. Japan’s Finance Minister Satsuki Katayama outlined the initial allocation at the ministerial meeting: approximately 2 billion yen for AI-assisted vulnerability assessments of critical government systems, 4.1 billion yen to strengthen police cybercrime investigation units, and 3.8 billion yen to reinforce the Digital Agency’s defences, according to Inspenet citing the Japan Times.
Read more: Organised fraud is outgrowing Asia-Pacific’s cyber insurance market
The Ministry of Economy, Trade and Industry is to establish a specialist team of cybersecurity experts by the end of November 2026. Members will conduct penetration testing to find security vulnerabilities and detect weaknesses in systems, using AI as part of their toolkit, and cooperate with technology companies and AI developers in allied nations. A separate rescue team, drawn from the public and private sectors, will provide emergency assistance to affected organisations.
Japan’s active cyber defence framework, which took partial effect on October 1, 2026, also factored into the government’s response. The framework, established under legislation enacted in May 2025, authorises designated officials to access and neutralise servers used in attacks, subject to independent oversight, according to law firm Baker McKenzie.
GMO Internet Group, a Tokyo-based internet infrastructure company, was among the affected organisations – it disclosed a breach of its Onamae.com Desktop Cloud service on October 20, 2026, and later offered compensation to affected customers, the company announced publicly and confirmed to the Associated Press.
GMO Cybersecurity by Ierae, a subsidiary of GMO Internet Group, traced attacks targeting Japanese companies to six servers, all of which had used Artex – a Chinese-language AI penetration testing tool – according to Nippon.com, citing Jiji Press. Japan’s Computer Emergency Response Team Coordination Centre (JPCERT/CC) separately confirmed signs of AI agents being used in cyberattacks against Japanese companies, as reported by Asian News Network.
For brokers placing cyber risks in Japan and across Asia-Pacific, the breach pattern creates a concrete basis for reviewing client coverage terms before the next renewal cycle.
Cyber insurance penetration across Asia remains structurally low. A May 2026 report by CyberCube and United Insurance Brokers found that in several Asian markets, fewer than 5% of small businesses currently hold standalone cyber cover – and even in more developed markets, including Japan, South Korea, Hong Kong, and Singapore, large organisations often purchase cyber insurance coverage at levels modest relative to their exposure.
The mandatory incident reporting provisions of Japan’s active cyber defence framework add a compliance dimension that is directly relevant at renewal. From October 1, 2026, designated critical infrastructure operators must notify the government of qualifying incidents, under the framework’s phased implementation schedule.
Read more: Cyber rates are falling, but insurers are asking harder questions
International cyber rates have also fallen roughly 43% since late 2023, even as claims severity has continued rising, according to specialist underwriter DUAL. The gap between softening pricing and rising loss experience means that brokers placing Japanese and regional risks face a submission environment where underwriters are asking more detailed questions about client controls and documented remediation steps, not fewer.
For clients still assessing whether their current cyber coverage is adequate, the November 2026 package provides a clear external reference point: the volume and severity of verified breaches in Japan reached a threshold that prompted emergency action at the highest level of government. That is a data point worth bringing to the next renewal conversation.
