HighII Cyber Warfare & Critical Infrastructure26 October 2026, Monday
Takaichi orders an emergency cyber package within a week after corporate breaches
Prime Minister Sanae Takaichi convened an emergency cybersecurity meeting on 26 October and asked her cabinet for a package of measures by the end of next week. GMO Internet Group, whose breach triggered the meeting, had refused a ransom demand of 50 million dollars.
Prime Minister Sanae Takaichi convened an emergency cybersecurity meeting on 26 October. She asked the cabinet to prepare a package of measures by the end of next week. It covers AI-assisted early vulnerability scanning of government systems and simulated attack testing run by IPA specialists.
Takaichi said the government could choose to 'reach and neutralise' where the circumstances of an attack are established, and gave no detail. She asked cybersecurity minister Toshiharu Furukawa to identify the source of the attack together with allied countries. The package also calls for a network monitoring the supply chain to be built quickly.
The trigger was unauthorised access to GMO Internet Group's foreign exchange trading service; some customers reported transactions they did not recognise. Chief executive Masatoshi Kumagai wrote that the company had not paid a crypto ransom demand of 50 million dollars, and asked the state for help on 24 October. The new law that makes active cyber defence possible had taken effect less than a month earlier.
Talay assessment
Bottom line
Japan legislated the authority for active cyber defence, but when the first large private-sector request arrived it had no operating model ready. A one-week deadline shows the gap sits in implementation rather than policy. If officials do reach into an attacker's server and disable it, that becomes the first concrete use of the power and puts the attribution threshold into public debate. The structural constraint is how fast small suppliers can be wired into the monitoring network.
Likely effects
- State-private interfaceNegativeWeeks
GMO asking the state directly for intervention exposed that the call-out mechanism the law envisages has yet to be defined in practice.
- Supply-chain monitoringPositive1–6 months
The package accelerates a monitoring network covering small firms; without it, the route into large companies stays open through their suppliers.
- Attribution and allied cooperationNegative1–6 months
The instruction to identify the source alongside allies shows Japan accepts that its own attribution capacity is limited.
Possibilities, ranked
- 1Package arrives on time55%
The cabinet announces the package in early November, weighted towards scanning and advisory services, with no intervention against an attacker's server disclosed.
Watch: The text of the cabinet decision in the first week of November
- 2Active defence used for the first time25%
The government announces that it has reached into an attacker's infrastructure and the scope of the power is debated publicly.
Watch: An intervention notice from the cybersecurity ministry
- 3The timetable slips20%
Disputes over ministerial authority and budget push the package into December.
Watch: No package announced by the middle of November
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Rejected ransom demand▼ 50 million dollars
- Deadline for the package▲ 1 week
- Age of the new law▼ under 1 month