On 5 November 2026 the National Cybersecurity Office of Japan's Cabinet Secretariat published a document for businesses titled "Measures against unauthorized access leading to leaks of personal information: thorough implementation of basic measures for websites and mobile apps".
On 6 November the Ministry of Internal Affairs and Communications (MIC) published a notice, labelled an alert to businesses, stating that it had sent the same alert to the businesses and industry bodies under its jurisdiction. MIC asks businesses that run services through websites or mobile apps and handle personal information to take particular care.
This page sets out what the National Cybersecurity Office and MIC published, together with the statutory wording.
Overview
| Item | Details |
|---|---|
| Date of the document | 5 November 2026 |
| Issued by | National Cybersecurity Office, Cabinet Secretariat |
| Title | Measures against unauthorized access leading to leaks of personal information: thorough implementation of basic measures for websites and mobile apps (in Japanese) |
| MIC notice | 6 November 2026 (notice titled as an alert to businesses) |
| MIC's action | Sent an alert with the same content to the businesses and industry bodies it oversees |
| Main audience | Businesses that run services through websites or mobile apps and handle personal information |
| Earlier MIC alerts | 9 October and 13 October 2026 (the latter on attacks exploiting information obtained by analyzing published apps) |
The situation described in the document
The document says the government has identified several recent incidents of data leaks caused by unauthorized access that appear to have resulted from causes such as:
- Inadequate security when developing mobile apps
- Misconfigured websites and similar systems
- Continued use of software that is out of support or has known vulnerabilities that have not been addressed
In each case, it says, basic measures at the organization itself or at its contractors appear not to have been sufficient.
The document says attackers appear to have carried out large-scale reconnaissance of Japanese websites accessible on the internet, broken into those where they found a way in, and stolen personal information. It says they are also highly likely to be using AI to research and compromise targets, and that in some cases risks rated relatively low in past vulnerability assessments may have been combined to make an intrusion possible.
It adds that because attacks can now easily be scaled up, a wide range of businesses, regardless of their size, are thought to be targets.
Free Tool Related to This Article
Contract Risk Checker
Try our free simulator related to this topic.
Try for free →The three groups of measures
The document has a general section aimed at a wide readership including senior management, and "example measures" aimed at IT and cybersecurity staff. The headings are as follows.
| Group | Heading | Main example measures |
|---|---|---|
| 1. Operation and management | (1) Knowing your digital assets and eliminating vulnerabilities | Keeping software component information (product, version, where used), using SBOM and SCA, collecting vulnerability information continuously, setting priorities and deadlines for fixes, managing mitigations and remediation |
| 1. Operation and management | (2) Continuously reviewing and minimizing the attack surface | Identifying systems exposed to the internet, stopping or restricting unnecessary public functions (admin screens, debugging features), monitoring external exposure continuously |
| 1. Operation and management | (3) Continuous vulnerability assessment and monitoring for suspicious behavior, including with AI | Continuous testing and inspection, monitoring and detection using logs, faster incident investigation and response |
| 2. Design and development | (1) Security by design | Secure architecture at the requirements and design stage, SAST and SCA in implementation, DAST and IAST in testing |
| 2. Design and development | (2) Stronger security for APIs | Eliminating authorization flaws, managing credentials securely, rate-limiting APIs |
| 2. Design and development | (3) Vulnerability testing before release | Setting security standards, choosing a suitable third-party vendor |
| 3. Supply chain | (1) Security governance over contractors and tighter control of contractors' connections | Multi-factor authentication on contractors' remote access, security requirements in contracts and procurement, access control based on zero trust |
| 3. Supply chain | (2) Proper management of open-source software and external libraries | Clear first-response procedures when serious vulnerabilities are disclosed, delivery and checking of an SBOM in outsourced development |
Operation and management
The document says attacks exploiting vulnerabilities in libraries and frameworks used inside web applications have been observed. It says organizations need to keep track of their software components, versions and where they are used, and should give priority to servers and network devices reachable from the internet.
It also says unauthorized access has been confirmed through system admin screens exposed to the internet and through debugging features that were never meant to be public. It states that testing, inspection and audits should be carried out not only before release but also at the time of material changes affecting authentication, authorization, APIs or the handling of personal information, and continuously after launch, according to risk.
Design and development
The document says data has leaked through unauthorized operations via the APIs used by web and mobile apps, and refers to "A2B (App-to-Backend) attacks", about which the National Institute of Information and Communications Technology (NICT) has issued warnings. The document says incidents have been reported in which published apps were analyzed to find API vulnerabilities or authorization flaws and confidential information was then taken from the back end.
On testing before release, the document says web applications and systems that handle personal information should undergo vulnerability assessment or penetration testing before release, and should go live only after fixes have been made and checked. It states that design and implementation flaws specific to back-end functions developed in-house or by contractors also need to be tested and fixed.
Attacks through the supply chain
The document says there have been cases in which attackers used the environment of a contractor or maintenance provider as a foothold to break into the client's systems, and that even then, the impact of service outages and data leaks falls on the client business itself.
As an example measure for contracts and procurement, it suggests including in specifications and outsourcing agreements, in addition to confidentiality obligations, requirements on:
- Procedures for subcontracting
- Notification duties and contact points when an incident occurs
- Deletion of data when the contract ends
When selecting contractors, it suggests using objective assessments such as third-party certification and the "Security Measures Evaluation Scheme for Strengthening Supply Chains (SCS evaluation scheme)", for which the document states applications are expected to open in March 2027. It also suggests requiring, when development or modification is outsourced, disclosure of the software components used and delivery of an SBOM (software bill of materials), to be checked on acceptance.
The document asks businesses, when requiring contractors to take measures, to discuss cost-sharing and methods fully and not to use their bargaining position to impose one-sided burdens.
FREE CONSULTATION
Corporate Law: your first 30 minutes are free
- ・Handled by Yusuke Abe, admitted in Japan and New York
- ・Online (Zoom etc.) or at our office in Otemachi, Tokyo
- ・In English or Japanese
The Act on the Protection of Personal Information
The document notes that where the handling of personal information is outsourced, Article 25 of the Act on the Protection of Personal Information requires necessary and appropriate supervision of the contractor. Article 25 provides (unofficial translation):
> A business operator handling personal information that entrusts the whole or part of the handling of personal data must exercise necessary and appropriate supervision over the entrusted person so as to ensure the security management of the personal data whose handling has been entrusted.
Article 23 (security management measures) provides (unofficial translation):
> A business operator handling personal information must take necessary and appropriate measures for the security management of the personal data it handles, including preventing the leakage, loss or damage of the personal data.
Article 26(1) requires a business to report to the Personal Information Protection Commission when a leak or other incident involving personal data occurs that is specified by Commission rules as likely to cause serious harm to individuals' rights and interests. Article 26(2) requires the business to notify the individuals concerned (except where notification is difficult and alternative measures are taken to protect their rights and interests).
Closing section of the document
The document says the measures it sets out focus on the recent series of attack methods, and that businesses also need measures that anticipate other methods, such as attacks on vulnerabilities in internet-facing network devices like VPNs, targeted email attacks and DDoS attacks, as well as more sophisticated misuse of AI.
It asks businesses, bearing in mind that the impact of a cyberattack can become a management risk, to assess risk based on the characteristics of their systems and the information they hold, under the judgment of top management, and to strengthen their cybersecurity measures as needed.
Sources
- MIC, "Measures against unauthorized access leading to leaks of personal information (alert to businesses)" (6 November 2026, in Japanese) https://www.soumu.go.jp/menu_kyotsuu/important/kinkyu02_000683.html
- National Cybersecurity Office, Cabinet Secretariat, "Measures against unauthorized access leading to leaks of personal information: thorough implementation of basic measures for websites and mobile apps" (5 November 2026, in Japanese) https://www.cyber.go.jp/pdf/press/261105_taiou.pdf
- MIC, alert on attacks exploiting information obtained by analyzing published apps (13 October 2026, in Japanese) https://www.soumu.go.jp/menu_kyotsuu/important/kinkyu02_000680.html
- e-Gov: Act on the Protection of Personal Information (Act No. 57 of 2003) https://laws.e-gov.go.jp/law/415AC0000000057
This page is based on what the government published and on the wording of the relevant laws. If you need advice on a specific matter, please consult a lawyer.