Japan Approves 10 Billion Yen Cybersecurity Push, Plans Expert Teams and Website Blocking Review

Emergency package targets attacks and the damage that follows

Japan approved 10 billion yen, about $63 million, in emergency cybersecurity funding on November 6, 2026, as Prime Minister Sanae Takaichi's government adopted measures to find security weaknesses, send specialists to businesses and examine blocking access to websites carrying stolen personal information.

The package, finalized at a meeting of relevant ministers at the prime minister's office, responds to repeated data breaches, including an attack involving GMO Internet Group Inc. that was accompanied by a ransom demand. It addresses both the initial break into a computer system and the harm that can follow when stolen information circulates.

A specialist team focused on testing and strengthening defenses is due to begin work in November. Another team will approach companies considered at risk before attackers strike, while a planned rescue team combining government and private sector experts will help businesses respond after an intrusion.

Takaichi, Japan's prime minister, called for a coordinated government response at the meeting:

bring its full force to bear on strengthening Japan's capacity to respond

The package has four pillars: stronger basic security using artificial intelligence, better information gathering and investigative analysis, strategic responses to attacks, and support for victims alongside measures to prevent further damage.

Those four areas connect tasks that can otherwise fall to different organizations. A company needs to repair weaknesses, investigators need information about the attacker, and customers need protection from the misuse of exposed records. Japan's plan seeks to bring those efforts together rather than stopping at the repair of a compromised system.

Why the GMO breach prompted action

Takaichi ordered officials to prepare the package on October 26 after a series of major personal data leaks. The concern had moved beyond stolen records to financial harm suffered by people whose information could be misused.

The earlier GMO breach and losses involved 26,739 servers that the company said were potentially affected, covering trading accounts at more than 70 securities firms, foreign exchange providers and other businesses in Japan and overseas. A customer in Kanagawa Prefecture said unauthorized foreign exchange trades had cost him more than 6 million yen.

For customers, the practical danger is that a breach can continue causing harm after the original intrusion has ended. Information taken from a company may be used to attempt access to financial accounts or to support other fraud. The government's inclusion of victim support and controls on the circulation of leaked data addresses that later stage.

The main steps in the response span several dates:

• October: A law enabling active cyber defense, including proactive access to servers used by attackers, took effect.
• October 26: Takaichi instructed ministers to prepare an emergency cybersecurity package.
• November 6: Ministers finalized the package and the government approved 10 billion yen from fiscal 2026 reserves.
• During November: The specialist security team and the team approaching companies at risk are scheduled to be established.
• Within the fiscal year: The government aims to establish the public and private sector cyber rescue team.

AI becomes part of basic security

Japan's package identifies inadequate basic defenses as a recurring problem in recent breaches. It also describes a faster threat: advances in artificial intelligence allow weaknesses to be exploited quickly and across many targets.

Security hygiene means the routine work of keeping computer systems protected, such as installing security updates, controlling access and checking for weaknesses. These tasks can sound ordinary, but an overlooked opening can give an attacker a route into sensitive records.

The government plans to use AI to help identify vulnerabilities and cooperate with advanced AI developers and overseas technology companies to keep information about weaknesses current. A vulnerability is a flaw that someone can exploit to enter a system or make it behave in an unintended way.

The urgency follows evidence of tools that can automate parts of an attack. In an earlier ARTEX security demonstration, Japanese cybersecurity company S&J said an AI agent collected fictional personal information from a test website in about 15 seconds. S&J president Nobuo Miwa said work that could take a person days could be completed by AI in seconds or minutes.

The government's response brings AI into defensive work as well. Automated checks can help specialists search for openings, while cooperation with technology companies can provide newer information about the flaws attackers may try to exploit.

Different teams for different stages of an attack

The specialist team, described as a "top gun" team, will bring together people with advanced technical knowledge. Its work will include penetration testing and strengthening security measures. Penetration testing is an authorized attempt to break into a system so its owner can find and fix weaknesses.

The outreach team has a different assignment: approaching companies that face potential risks and encouraging preventive action. Its planned November launch would create a channel for intervention before a business becomes a victim.

The cyber rescue team will combine public and private sector expertise and assist businesses during their initial response to an attack. The government aims to establish it within the fiscal year, later than the two teams scheduled for November.

These assignments cover three practical stages: checking defenses, warning organizations about risks and helping when an attack happens. For a business facing an intrusion, access to outside specialists could provide help at the moment it must assess what has happened and decide how to respond.

What the 10 billion yen will fund

The government approved the 10 billion yen allocation from fiscal 2026 general account reserve funds on November 6. Reserve funds are money already set aside in the budget that the government can draw on for needs arising during the fiscal year.

The allocation will support inspections for vulnerabilities in computer systems operated by government institutions and other public organizations. It will also pay for the purchase and upgrading of cybersecurity equipment, including police equipment for gathering and analyzing intelligence.

Finance Minister Katayama said the funding would support coordinated protection across ministries and agencies:

By making use of these reserve funds, we will work closely with the relevant ministries and agencies to ensure that all necessary security measures are in place,

Takaichi also instructed the finance minister and other relevant ministers to consider the funding needed to carry out the emergency measures. The spending decision gives agencies resources for immediate inspections and equipment while the new teams are being organized.

Active cyber defense moves beyond protecting individual networks

Japan also plans to strengthen its ability to neutralize threats by proactively accessing servers used by attackers. The government describes this approach as active cyber defense, enabled by a law that took effect in October.

A server is a computer that provides services or stores information for other computers. Attackers can use servers to direct malicious activity or hold stolen data. Accessing those systems gives the government a way to act against infrastructure supporting an attack, alongside protecting the Japanese organizations being targeted.

Takaichi instructed cybersecurity minister Toshiharu Furukawa to consider revisions to the Cyber Response Capability Enhancement Act. That places possible legal changes alongside the operational measures already included in the emergency package.

The combination is important for understanding the government's approach. Some measures concern how companies maintain their own systems. Others concern powers exercised by the state against an attacker's infrastructure, requiring a different legal and operational framework.

Blocking leaked data websites requires legal review

The government will accelerate consideration of blocking access to websites that display leaked personal information. It is also considering allowing telecommunications carriers to block access to particular websites or servers linked to cyberattacks.

Blocking would mean preventing connections to specified destinations through telecommunications networks. Its intended role in the package is to limit further harm after an initial breach, including the continued exposure of personal information.

Japan's constitutional protection for the secrecy of communications is central to the review. The package calls for urgent examination of legal issues before moving ahead. The blocking proposal remains under consideration, with its scope, safeguards and implementation timetable still to be settled.

For people whose records have been exposed, this part of the package concerns what happens to their information after it leaves the original company's control. For telecommunications carriers, it would involve responsibilities extending beyond the security of their own networks.

National security incidents get a separate response

Incidents that could seriously affect national security will receive support from a team including officials from the National Cybersecurity Office, the National Police Agency and the Defense Ministry, among other bodies.

The arrangement brings national cybersecurity coordination, policing and defense into the same response. It sits alongside the planned rescue team for affected businesses, giving the government a separate mechanism for incidents with broader national consequences.

Better information gathering and analysis support both tracks. Police equipment funded through the reserve allocation, cooperation with overseas technology companies and the sharing of vulnerability information all serve the package's aim of detecting and responding to threats more effectively.

November launches are the next practical test

The first scheduled milestones are the establishment of the specialist team and outreach team during November. The cyber rescue team follows on a timetable extending to the end of the fiscal year.

Those launches will begin translating the package into help for organizations: technical testing, warnings before an attack and assistance after one. Government and public organizations will also receive vulnerability inspections supported by the emergency allocation.

The legal work proceeds alongside those operational steps. Furukawa has been asked to consider revising the response law, while the government examines how website blocking could operate within communications protections. Japan's emergency response therefore combines immediate spending and staffing decisions with proposals that still require legal decisions.

Key Points

• Japan finalized its emergency cybersecurity package on November 6, 2026, following major personal data breaches.
• The government approved 10 billion yen, about $63 million, for inspections, equipment and other cybersecurity measures.
• A specialist testing team and an outreach team are scheduled to launch in November.
• A public and private sector rescue team is planned within the fiscal year to help attacked businesses.
• The package includes AI assisted security checks and stronger cooperation with overseas technology companies.
• Website blocking remains subject to legal review, including Japan's protection for the secrecy of communications.
• Officials from cybersecurity, police and defense bodies will support incidents that could seriously affect national security.