Japan’s PM asks for attack reports the same day; ¥10bn set aside

01What the Prime Minister asked for

The package has four pillars, in her words (our translation): making sure basic measures are taken, “including with AI”; gathering and pooling information, with stronger investigation and analysis; a strategic response to cyberattacks; and more support for victims, with steps to stop damage spreading.¹ She then gave four instructions:

• The cyber security minister, Furukawa, is to study amending the Cyber Response Capability Enhancement Act (サイバー対処能力強化法) to improve the government’s ability to collect information on attacks aimed at Japan.
• The time it takes information to reach the National Cybersecurity Office (国家サイバー統括室) must be “greatly shortened”, to keep pace with “the speed of cyberattacks in the AI era”: hence the same-day goal for core infrastructure operators.
• The office is to study, “referring to examples in major countries”, a way for it to detect and analyse suspicious traffic to private companies, “in addition to current government bodies”.
• The National Security Secretariat is to lead work on rules, for the public and private sectors, that reduce supply-chain risk in IT systems and equipment, while government systems are inspected.

The finance minister is to keep working on money for the whole package; the ¥10bn covers what is needed immediately.¹

02The rule it would tighten, in force for five weeks

The Act was passed on 16 May 2025, and its reporting duty took effect on 1 October 2026. Japan has designated 258 core infrastructure operators in 15 sectors, from 65 in finance and 48 in electricity to one in postal services (as of 1 July 2026).³ When one of them learns that a designated critical computer has been compromised, or of certain events that could lead to that, it must report “promptly” (速やかに) to its sector minister and the Prime Minister, and file a full report within 30 days of learning of it.⁴ “Promptly” carries no hour count; the Prime Minister’s goal would put one on it. Provisions on the government’s use of communications data are due by November 2027.³

The first meeting, on 26 October, had followed “large-scale information leaks” at Japanese companies. It ordered vulnerability checks of every ministry’s systems “using high-performance AI” brought forward, drawing on the expertise of AISI Japan (the AI Safety Institute), and asked the trade ministry and the information-technology agency IPA to bring forward simulated attack tests in which skilled testers use such AI to find flaws. It set the package for “around next week” (our translations).² The government’s text names no incident; in October the Journal covered ransomware at the Japanese cloud provider IDC Frontier.

In India, CERT-In’s directions of 28 April 2022 already require service providers, data centres, companies and government bodies to report listed incidents within 6 hours of noticing them.⁶ To watch in Japan: the package text, a deadline in hours written into the ordinance, and the amendment bill.