Earlier this month, Japan’s government declared a cyber emergency. The move followed a series of cyber attacks against businesses and institutions across the country. Rail transport, internet services, retailers and even the police have been impacted, according to the Financial Times.

At one point, the Japanese financial services regulator even told banks not to accept driving licences as proof of identity for anyone opening new accounts.

The declaration by Japan’s NCHS cyber agency is unusual. Few countries have declared a cyber emergency, even if security services and regulators have warned of heightened threats.

The move came after rail operator JR East reported the loss of 1.67 million email addresses, and car rental company Times Car lost a large number of scans of its customers’ driving licences. In addition, cloud services operator IDC Frontier reported a ransomware attack. This, in turn, linked to the leak at JR East and other public sector bodies.

“Incidents like this highlight why supply chain attacks can be so disruptive,” Alexandra Rose, head of global affairs and policy at cybersecurity company Sophos told .

“An attacker doesn't need to compromise a bunch of organizations individually in order to have a widespread impact. They gain access to a single organization and then can move through interconnected systems or disrupt services that many other organizations depend on. We’ve seen the downstream consequences extending beyond the initial victim time and time again, affecting operations, customers, and more.”

Big in Japan?

Japan, though, is not generally viewed as more exposed to cyber attack than other advanced economies, experts say. But the country is certainly seeing an increase in the seriousness of attacks, if not their frequency. There is also evidence that some businesses, at least, were less well prepared.

“I think it’s a response to the increasing severity of attacks they are seeing,” Rob Demain, founder of security firm e2e-assure, told . “One of the key ones was the platform IDC Frontier that was taken offline. I think it’s a trend of more impactful cyber attacks being seen, and trying to move quicker and keep pace.”

The Japanese government also moved to bring in active cyber defense (ACD), where police and other organizations can go after attackers, taking down servers and, hopefully, neutralizing attacks. Japan is also considering wider changes to its cybersecurity strategy, after lawmakers recently called to strengthen its use of AI for cyber defense.

But publicly announcing a cyber emergency brings its own risks, not least that businesses may rely on government intervention instead of taking proactive measures themselves. And useful advice could be lost in increased noise.

“How many times can you cry ‘cyber emergency’ before people stop worrying about it?” asks Demain. “But I don’t think there has been anything similar in Japan. So I think if you hear that message, you are going to take notice… You need to make sure everyone’s taking this seriously, and that was just one method to get the message out.”

Not everyone is convinced, however.

“A cyber emergency declaration has value if it changes the response, not just the rhetoric,” cautions Nazir Esmail, chief autonomous enterprise officer at Sapiens, a business that develops software primarily for the insurance industry.

“CISOs are well versed in threat vectors and don’t need additional warnings that threats are on the rise. What would be useful to CISOs and the security community in general, is faster access to actionable intelligence. In addition, if attacks threaten critical services or infrastructure, a coordinated incident response effort and a clear escalation mechanism are essential to contain the impact and accelerate recovery,” he told .

Actions, not words

This poses the question of whether declaring an emergency has a practical value for enterprises, and the wider security community. If it brings additional assistance or funding, then CISOs would no doubt welcome it. And government positioning can help security leaders to promote security to the board.

As Charl van der Walt, head of security research at Orange Cyberdefense points out, a full state of emergency can unlock new resources. This, he recalls, happened in Costa Rica in 2022, when the country declared a state of national emergency following a series of ransomware attacks against public sector bodies. But Japan’s cyber emergency stops short of that.

“The Japanese story seems to me to be a bit of a knee jerk response to a series of incidents that happened online,” he told . “The latest one was an attack against an infrastructure as a service provider. They have about 500 businesses that depend on them, and so the impact on them cascaded through the whole ecosystem.”

Van der Walt likens the incident to a similar attack on a shared software platform in South Korea, which also impacted a large number of businesses. But, he adds, we see fewer public data leaks in Japan than the size of the economy would suggest. “One reason may be that Japanese businesses are just paying [the ransom] before there’s any leaks,” he suggests.

We also do not know what the Japanese government’s, or indeed any government’s, playbook is for a cyber emergency, and for good reason. Given cyber attacks are increasingly part of grey zone conflict or hybrid warfare, governments will want to keep potential adversaries guessing.

“There’s two facets to think about,” says van der Walt. “One is the signalling effect to the adversary, and that’s really an issue for diplomacy and international humanitarian law. How do you keep your adversaries in check? How do you keep them constrained? Signalling is a big part of that.”

The other is the impact on the wider population, and overall cyber awareness. CISOs stand to benefit, at least indirectly, if employees, customers and other stakeholders have a better understanding of cyber risk.

“You also need to signal to your populace. You need to maintain the health, the sense of confidence, and the trust that your economy and society have,” he says. “I don’t know Japan’s playbook and I don't know their rationale. But I would think this needs to be done very, very cautiously.”