--- title: "Japan's cyber emergency package is right. It st… | Firevault" url: https://fire-vault.com/news/japan-emergency-cybersecurity-package-commentary-2026 description: "Japan has announced a 10 billion yen emergency cybersecurity package, with AI defence and cyber rescue teams, after a wave of breaches. Mark Fermor argues…" lang: en-GB --- Breaking News Updated as information becomes available Image: Illustration of the Tokyo skyline at night linked by glowing network lines, with one magenta connection physically severed (https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/japan-emergency-cybersecurity-package-commentary-2026.jpg) Opinion · Commentary · Breaking # Japan's cyber emergency package is right. It still assumes everything stays connected. Japan has announced a 10 billion yen emergency cybersecurity package, with AI defence and cyber rescue teams, after a wave of breaches. Mark Fermor argues that faster response must be matched by reducing what attackers can reach at all. Image: Mark Fermor, CTO, CMO and Founder of Firevault (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) **Mark Fermor**CTO, CMO and Founder, Firevault Published 7 November 2026 · 6 min read Share LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fjapan-emergency-cybersecurity-package-commentary-2026)Email ## What happened Japan has declared what amounts to a national cyber emergency in all but name. On Friday 6 November 2026, Prime Minister Sanae Takaichi announced an emergency cybersecurity package after a wave of data breaches hit major companies and government agencies, ABC News reported (https://abcnews.com/amp/International/wireStory/japan-announces-emergency-cybersecurity-package-wave-attacks-137911772), carrying an Associated Press wire story. "At this very moment, cases of unauthorized access and data breaches are occurring, causing a major impact on daily lives of the people and corporate activities," Takaichi told a ministerial meeting. "Let us increase the response capability across Japan by devoting all government resources." The package is initially funded with 10 billion yen (about $63 million) from the government's budget, although Reuters, via CNA (https://www.channelnewsasia.com/asia/japan-cybersecurity-package-hacking-attacks-6531921), reported that the overall cost is likely to be higher. According to the AP report, it includes: - a "top gun" team of specialists, set up by the Ministry of Economy, Trade and Industry by the end of November, using AI to counter attackers and find weaknesses in network systems; - a public-private "cyber rescue team" to provide the first response for companies that have been attacked, with a separate team helping vulnerable companies strengthen their defences; - a joint support team drawn from the Defence Ministry, the National Police Agency and the National Cybersecurity Office for attacks that could challenge national security; - greater use of "active cyber defence", the power to access servers used by attackers, which AP reports was legalised in October. Bloomberg (https://www.moneycontrol.com/world/japan-hit-by-spate-of-cyberattacks-pm-takaichi-unveils-10-bn-emergency-cybersecurity-package-article-14073810.html), citing the Nikkei, reported that about a fifth of the money will fund an AI-led sweep of critical infrastructure (https://fire-vault.com/control-for-critical-infrastructure) and government systems for vulnerabilities by March. The ruling Liberal Democratic Party has described the situation as "the eve of a cyber emergency". ## Why Japan acted now The package follows weeks of incidents. On 2 November, AP reported (https://apnews.com/article/hack-cyberattack-security-gmo-japan-1a14fac1015f2bbca62a07358615af19) that GMO Internet Group had apologised after unauthorised access to its Onamae.com Desktop Cloud service led to leaked information and transactions customers did not recognise, affecting dozens of securities firms and other businesses, with more than 26,000 cases. GMO said the attackers deployed ransomware, that it refused to pay, and its chief executive acknowledged the company had been warned internally about a systemic weakness but had not acted on it. Last month we also reported on the cyberattack on cloud provider Arcadia (https://fire-vault.com/news/arcadia-cyberattack-japan-police-data-breach-2026), which may have exposed data on 125,000 Japanese police officers and staff. ## The government's own diagnosis is the most important part The most striking line is not about money or new teams. According to Jiji Press (https://www.jiji.com/jc/article?g=pol&k=2026110500942), the package itself states that many recent leaks involved cases where basic measures were not sufficient, and that advances in AI mean such gaps can now be exploited in a short time and at large scale. Reporting by Impress Watch, summarised by Osegi (https://osegi.com/en/japan-emergency-cybersecurity-package-10-billion-yen), lists the basics in question: unpatched known vulnerabilities, misconfigured websites and weak security in application development. That is an honest assessment, and it deserves credit. It is also the heart of the problem. **If AI can find and exploit a gap in hours, every system that is permanently reachable is permanently being tested.** Patching, scanning and faster reporting all matter. The package's requirement that attack information reach the National Cybersecurity Office within hours, or at least the same day, is a real improvement. But every one of those measures still starts from the same assumption: that the systems and data being defended will remain connected, and that the defender must win the race every time. ## A response model, not yet a reachability model Read the four pillars closely: stronger basic measures, better intelligence and investigation, strategic response to attacks, and support for victims. Each is necessary. Taken together, they describe a country getting much better at detecting, responding to and recovering from attacks on connected systems. What is largely missing is the question that comes before all of them: **Which systems and data should not be continuously reachable in the first place?** A cyber rescue team arriving within hours is welcome. A recovery copy that was offline throughout the attack means there is something clean for that team to restore. A sweep that finds vulnerabilities by March is welcome. An engineering connection into a critical system that exists only while approved work is under way, and is physically absent the rest of the time, leaves an attacker nothing standing to find. ## What this means beyond Japan Japan's experience is not unusual. It is simply further along a curve that the UK and Europe are also on. The same pattern of cloud dependencies, standing remote access and backups that sit on the same network as the systems they protect appears in breach after breach, including the Binance theft (https://fire-vault.com/news/binance-hack-biggest-crypto-heist-2026) reported days before GMO's apology. Governments can fund rescue teams. Boards still have to decide what their organisation keeps connected. ## Where Firevault fits At Firevault we argue that resilience has two halves. The first is defending the connected estate, and Japan is right to invest heavily in it. The second is reducing what needs to be connected at all. Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® keeps an organisation's most valuable data and recovery copies on dedicated hardware that is physically disconnected and offline by default. Authorised access is established when required and removed when the session ends. Control by Firevault applies the same principle to operational connections: just-in-time access, so a path into a critical system exists when approved work needs it and physically does not when it does not. Neither replaces patching, monitoring, investigation or incident response. Neither can protect data while it is deliberately connected for use. What both do is remove standing paths that an attacker, human or AI-assisted, would otherwise be able to probe around the clock. **Japan has decided to fight AI-speed attacks with AI-speed defence. The quieter, more durable answer is to make sure the things that matter most are not there to be attacked when no one needs them.** _Mark Fermor is CTO, CMO and Founder of Firevault. Learn why offline storage is different (https://fire-vault.com/why-oss) or talk to the team (https://fire-vault.com/contact)._ ## Questions According to AP and Reuters reporting, it is initially funded with 10 billion yen (about $63 million) and includes an AI-enabled specialist team, a public-private cyber rescue team, a joint national security support team, wider use of active cyber defence and an AI-led sweep of government and critical systems for vulnerabilities. The government acted after dozens of companies and government agencies reported unauthorised access and data leaks in recent weeks, including the GMO Internet Group cloud incident reported by AP on 2 November 2026. Its measures focus on detecting, responding to and recovering from attacks on connected systems. Firevault argues organisations should also decide which data and systems need not be continuously reachable, such as recovery copies and standing remote access into critical systems. About the author **Mark Fermor** CTO, CMO and Founder of Firevault. Mark writes on physical control, offline storage and the incidents that show why both matter. ## More commentary - Commentary · 24 Oct 2026**The PRA is right to warn the City. But resilience needs more than supervision.**_Read the analysis_: https://fire-vault.com/news/pra-city-cyber-warning-commentary-2026 - Commentary · 14 Sept 2026**Revolut handed customer data to criminals for five months. Then came a $3 million ransom demand**_Read the analysis_: https://fire-vault.com/news/revolut-fake-government-requests-data-breach-2026 - Commentary · 9 Sept 2026**When data theft becomes personal: what we discussed at The Chelmsford Club**_Read the analysis_: https://fire-vault.com/news/data-theft-becomes-personal-chelmsford-club-inner-circle-2026 - Commentary · 4 Jul 2026**Nissan / PeopleSoft Breach: When HR Is Also Your Financial Data Repository**_Read the analysis_: https://fire-vault.com/news/nissan-oracle-peoplesoft-shinyhunters-commentary - Commentary · 4 Jul 2026**Tata / Apple Leak Shows Why Supply-Chain Data Belongs Off the Wire**_Read the analysis_: https://fire-vault.com/news/tata-apple-iphone-18-supply-chain-leak-commentary - Commentary · 4 Jul 2026**Conwy Council Breaches Show the Insider Threat Regulators Keep Underestimating**_Read the analysis_: https://fire-vault.com/news/conwy-council-insider-data-breach-commentary Back to the Knowledge Vault: https://fire-vault.com/learn/knowledge Image: Offline Secure Storage icon (https://fire-vault.com/__l5e/assets-v1/a78723d3-5b1a-48bf-9040-c767b759823d/oss-icon-correct.png) Why #OSS ### Keep a clean copy out of reach. Offline Secure Storage® keeps one copy physically disconnected at the hardware level between sessions. Why #OSS: https://fire-vault.com/why-oss Image: Control by Firevault icon (https://fire-vault.com/__l5e/assets-v1/9c97df8c-bca8-45bc-86f3-ec698db3afe8/control-icon.png) Control ### Govern the paths attackers depend on. Physical, out-of-band control of selected network paths, composed into ten Blueprints. Explore Control: https://fire-vault.com/control Image: Vault (https://fire-vault.com/__l5e/assets-v1/b9413e6e-5b45-442d-ab80-67cf0c578ba6/oss-approved-vault.png) Ready to start? ### Create your Vault online. Business Vaults from £360 a month inc VAT, on a 36-month commitment. Get started: https://fire-vault.com/get-started Book a demo: https://fire-vault.com/demo Get started ## Structured data ```json [ { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/japan-emergency-cybersecurity-package-commentary-2026#webpage", "url": "https://fire-vault.com/news/japan-emergency-cybersecurity-package-commentary-2026", "name": "Japan's cyber emergency package is right. It st…", "description": "Japan has announced a 10 billion yen emergency cybersecurity package, with AI defence and cyber rescue teams, after a wave of breaches. Mark Fermor argues…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/japan-emergency-cybersecurity-package-commentary-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/japan-emergency-cybersecurity-package-commentary-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/japan-emergency-cybersecurity-package-commentary-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Japan's cyber emergency package is right. It still assumes everything stays connected.", "item": "https://fire-vault.com/news/japan-emergency-cybersecurity-package-commentary-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Japan's cyber emergency package is right. It still assumes everything stays connected.", "description": "Japan has announced a 10 billion yen emergency cybersecurity package, with AI defence and cyber rescue teams, after a wave of breaches. Mark Fermor argues that faster response must be matched by reducing what attackers can reach at all.", "url": "https://fire-vault.com/news/japan-emergency-cybersecurity-package-commentary-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/japan-emergency-cybersecurity-package-commentary-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/japan-emergency-cybersecurity-package-commentary-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/japan-emergency-cybersecurity-package-commentary-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/japan-emergency-cybersecurity-package-commentary-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-11-07T12:45:00+00:00", "dateModified": "2026-11-07T12:55:03.764939+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/japan-emergency-cybersecurity-package-commentary-2026" }, "inLanguage": "en-GB", "articleSection": "Commentary", "wordCount": 1005, "keywords": "Japan's, Commentary, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## What happened Japan has declared what amounts to a national cyber emergency in all but name. On Friday 6 November 2026, Prime Minister Sanae Takaichi announced an emergency cybersecurity package after a wave of data breaches hit major companies and government agencies, [ABC News reported](https://abcnews.com/amp/International/wireStory/japan-announces-emergency-cybersecurity-package-wave-attack", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is in Japan's emergency cybersecurity package?", "acceptedAnswer": { "@type": "Answer", "text": "According to AP and Reuters reporting, it is initially funded with 10 billion yen (about $63 million) and includes an AI-enabled specialist team, a public-private cyber rescue team, a joint national security support team, wider use of active cyber defence and an AI-led sweep of government and critical systems for vulnerabilities." } }, { "@type": "Question", "name": "Why did Japan announce it now?", "acceptedAnswer": { "@type": "Answer", "text": "The government acted after dozens of companies and government agencies reported unauthorised access and data leaks in recent weeks, including the GMO Internet Group cloud incident reported by AP on 2 November 2026." } }, { "@type": "Question", "name": "What does the package not address?", "acceptedAnswer": { "@type": "Answer", "text": "Its measures focus on detecting, responding to and recovering from attacks on connected systems. Firevault argues organisations should also decide which data and systems need not be continuously reachable, such as recovery copies and standing remote access into critical systems." } } ] }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } } ] ```