Japan's cyber risk pools at shared suppliers while policies cover single firms

Noise at a record, signal in shared infrastructure

Chief Cabinet Secretary Minoru Kihara said on 30 October that data on about 260 million people had leaked, or was at risk of leaking, between 1 April and 16 October. The headline carried that number, but the count includes the same person several times across incidents and excludes financial and telecom companies. The real change is in the pace of incidents. According to Jiji, reported cases ran below 200 a month until the end of June, then rose to 212 in July, 303 in September and 830 in October.

The signal lies in the source of that pace. According to PayCloud Holdings' report of 2 November, an attacker entered Arara's shared environment between 28 and 31 October and took data from 97 servers belonging to client companies. Up to 380 companies were affected; Asoview reported 15,821,184 records, the Bic Camera group about 14.9 million and Mos Food Services 7,517,087. ITmedia reports that at least 3 other email distribution services have suffered unauthorised access since October. In other words, the target is not individual retailers but the shared layer that serves them.

Same week, same pattern

The pattern is not confined to Japan. According to Focus Taiwan, Bank SinoPac said on 4 November that 427 unauthorised transfers the previous day were made by breaching the security settings of suppliers behind its new mobile banking system. About NT$41.76 million was withdrawn from 419 accounts, and the bank said it would seek compensation from the supplier.

In telecoms, NTT Docomo said on 6 November that ID document numbers and bank account details of up to about 300,000 people had leaked and that it would pay compensation. According to Anadolu Agency, a nationwide outage of voice, data and messaging began at 11:18 local time on 5 November. Docomo said any link between the two incidents was unclear; as of 8 November that link could not be verified.

Policies per company, losses from one event

This is where the insurance constraint comes into focus. According to Innovatopia's 22 October review, cover for a breach at a supplier varies by insurer in Japanese policies. Mitsui Sumitomo explicitly covers leaks of third-party data entrusted to the insured's management. Tokio Marine excludes outages of electricity, telecom and internet infrastructure outside the insured's direct control. As of 22 October, public documents did not make clear whether cloud services fall within that exclusion.

Even where cover exists, the ceiling is low. In the same review, sample policies from the major insurers cap apology payments at 1,000 yen per person. At that cap, paying each of the 7,517,087 records Mos reported would cost about 7.5 billion yen; the calculation is Talay's own, and the company has announced no such payment. The base is thin too: in the General Insurance Association of Japan's 2025 survey, only 8.8% of SMEs had cyber cover, down from 10.0% in November 2024.

The upshot is that the losses of 380 companies stem from a single event, yet each company pays within its own policy, and often from its own balance sheet. For insurers that means accumulated risk, with claims from the same breach arriving in the same renewal period. As of 8 November it could not be verified that this accumulation had fed into any insurer's renewal terms.

The state builds a rescue team, not a pool

According to AP, Prime Minister Sanae Takaichi announced an emergency cyber package worth about 10 billion yen on 6 November. It includes an expert team to be set up under the Economy Ministry by the end of November and a public-private rescue team to provide first response to companies under attack. AP's summary mentions no insurance, state pool or supplier certification. The package therefore shares the cost of response during an attack but leaves the compensation and business interruption bill with companies.

There are 3 thresholds to watch. The first is whether the Commission's November case count stays above October's 830. The second is when, and under what audit, Arara reopens a service that has been shut since 31 October. The third is Docomo's compensation per person: the further it exceeds the 1,000-yen policy cap, the clearer it becomes that the difference is being paid from equity.