Unless otherwise noted, the numerical data in this article was collected and analyzed under the following conditions:
- TrendAI independently compiled primary-source disclosures such as press releases from affected organizations and posts on their official social media accounts.
- Cases supported only by news reports, without verifiable primary-source information, were excluded.
- Each incident was counted as one case. Separate incidents announced by the same organization were counted separately.
- Multiple announcements concerning the same incident, such as an initial notice and subsequent updates, were counted as one case. New information may change the incident count or category—for example, from “data leakage confirmed” to “no data leakage,” or from “unauthorized access” to “ransomware.”
- Incidents affecting the overseas operations of Japan-based organizations were included.
- Only cases in which a cyberattack was confirmed were included. Lost information, misdirected email, other operational errors, and configuration errors with no clear evidence of third-party access were excluded.
- This article is based on data available as of October 9, 2026. Figures may differ from those in earlier quarterly analyses because of factors such as the addition of disclosures from secondary organizations affected by data leaks and the retrospective disclosure of older incidents.
607 Security Incidents from January to September 2026—2.2 per Day
Disclosures through September already exceeded the total for all of 2025
Japanese organizations disclosed 607 security incidents from January through September 2026, an average of 2.2 per day. By comparison, 594 incidents were disclosed during all of 2025, an average of 1.6 per day. By the end of September, both the total number and daily frequency of incidents in 2026 had already exceeded the full-year figures for 2025. The January–September 2026 total was also the highest for the same period in the past three years, from 2023 through 2025.
As of October 9, the latest date covered when this article was written, the 2026 total had reached 659 incidents. This had already surpassed the 645 incidents recorded in 2024, making 2026 the highest year on record to date.
Monthly incident disclosures have also increased since April 2026. In October, 52 incidents were disclosed during the first nine days alone. Because disclosures often trend upward in the second half of the year, the pace of increase in 2026 may continue through year-end.
Attack categories for incidents disclosed from January to September 2026
Figure 3 groups the security incidents announced by Japanese organizations by attack category. Unauthorized access was by far the most common category, accounting for 331 incidents, or 54.5%. Organizations often use this broad term when the details of an incident are still unclear at the time of disclosure. It is also difficult to avoid because unauthorized access is involved in many types of cyberattacks.
Organizations sometimes publish additional facts as an investigation progresses. However, only 186 of the incidents disclosed from January through September 2026—30.6%—had a second or subsequent update. The sharp increase in disclosures during the second half of September means that some cases may not yet have received an update. More broadly, the limited number of follow-up disclosures may reflect resource constraints at affected organizations and the need to prioritize business recovery over a full root-cause investigation.
When TrendAI collects and analyzes incident data, it attempts to identify the most specific attack category possible. For example, even if an affected organization describes an incident as “unauthorized access,” TrendAI classifies it as ransomware when the disclosure also mentions data or file encryption.
More frequent announcements are not automatically better. However, because affected organizations currently have considerable discretion over whether to share an incident’s root cause, there is substantial value in continuing to disclose facts uncovered during an investigation. These disclosures can become important sources of information for other organizations. Regularly monitoring incident trends can therefore help organizations reduce their own cyber risk.
The next most common category was ransomware, with 82 incidents, or 13.5%. Third was data supply chain incidents, a category that TrendAI began tracking in 2026, with 62 incidents, or 10.2%. Ransomware is discussed later in this article. A data supply chain incident occurs when an organization entrusted with data suffers a cyberattack and the organizations that supplied the data subsequently disclose their own exposure.
Since 2023, cyberattacks against printing, warehousing, logistics, and similar service providers have repeatedly led large numbers of client organizations to disclose related impacts over time. From January through September 2026, attacks announced by companies including YCC Information System Co., Ltd. and Temairazu, Inc. led many client organizations to report data leakage.
Did cyberattacks really surge beginning in September 2026?
As noted above, the number of security incidents disclosed from the second half of September through early October 2026 increased sharply. In response, Japanese public-sector bodies—including the National Cybersecurity Office (NCO), Financial Services Agency, and JPCERT/CC—issued alerts in close succession. But did cyberattacks themselves increase during this period? The following analysis examines the timing of publicly disclosed incidents.
Of the 90 security incidents disclosed in September 2026, 63 announcements specified when the attack was detected or the damage discovered. Table 1 compares that date with the date of the initial public disclosure.
| Time from attack detection or discovery to initial disclosure | Incidents (share) |
|---|---|
| Same day or 1 day | 13 (20.6%) |
| 2–7 days | 28 (44.4%) |
| 8–15 days | 9 (14.3%) |
| 16–30 days | 6 (9.5%) |
| 31 days or more | 7 (11.1%) |
As the table shows, approximately 80% of cases were initially disclosed within 15 days of detection or discovery. In other words, the incidents were generally detected or discovered during roughly the same period in which they were first announced. This indicates that cyberattacks against Japanese organizations did in fact increase in September.
Ransomware incidents remained broadly unchanged
Many ransomware incidents were disclosed in 2026, but the total was broadly unchanged year over year: 82 incidents from January through September 2026, compared with 79 during the same period in 2025. Organizations should remain vigilant because ransomware disclosures have historically increased from October through December and into the first quarter of the following year.
Attack Surface Analysis of Incidents Disclosed from January to September 2026
Public-facing systems accounted for approximately 40% of incidents
Next, we examined the distribution of attack surfaces among incidents disclosed from January through September 2026. Of the 375 incidents for which the attack surface was known, public-facing systems—web servers, web applications, and cloud servers—accounted for approximately 40%, or 38.7%. That was roughly 10 percentage points higher than in 2025, when incidents involving public-facing systems accounted for 30.3% of the annual total.
Mail servers and VPNs were excluded because the disclosures did not always make clear whether they were public-facing. Email and cloud accounts were also excluded because the relevant security measures differ from those for other public-facing systems.
Public-facing systems are internet-connected information assets and among the assets most exposed to cyber risk. Although the importance of asset visibility has been emphasized for years, security teams should verify again whether they have an accurate view of the security posture of all public-facing systems that support the business.
Industries Affected by Incidents Disclosed from January to September 2026
Manufacturing, services, and IT services and telecommunications providers ranked highest
Figure 6 shows the distribution of affected organizations by industry. Manufacturing ranked first with 119 incidents, or 19.6%, followed by services with 116 incidents, or 19.1%, and IT services and telecommunications providers with 74 incidents, or 12.2%. This distribution is influenced by the overall distribution of organizations across Japanese industries. The data alone therefore does not demonstrate that security incidents are concentrated in, or that risk is inherently greater for, any particular industry.
With that caveat in mind, the following are the main observations for January through September 2026 and changes from the full-year 2025 results.
Manufacturing: Manufacturing remained the leading category, as it was in 2025. This likely reflects the large share of manufacturing companies in Japan’s industry mix. Numerous ransomware and unauthorized access incidents were reported.
Services: Services rose from third place in 2025 to second. Organizations in this sector often operate many public-facing systems. Numerous incidents were disclosed involving suspicious authentication screens linked to polyfill.io and cyberattacks against public-facing systems beginning in the second half of September. The category also includes the hospitality industry, where unauthorized logins to hotel reservation management systems continued to be reported, as they were in 2025.
IT services and telecommunications providers: This category rose from fourth place in 2025 to third. Several affiliated companies disclosed secondary impacts stemming from unauthorized access to an email service provided by a major telecommunications company. Providers of rental servers and data centers also disclosed multiple unauthorized access incidents. In addition, ransomware and unauthorized access affected service providers contracted by companies in other industries to build or operate IT systems.
Recommendations and Conclusion
What should organizations prioritize?
This article reviewed security incidents disclosed by Japanese organizations from January through September 2026. As our previous annual incident reviews have repeatedly emphasized, attackers will continue to target organizations where they can find an opening. From a defender’s perspective, those openings are cyber risks. Organizations should reassess the information assets they own or entrust to service providers—including IT systems, data, and accounts—from the following perspectives.
Gain visibility into the security posture of information assets. Establish an objective inventory of the information assets the organization owns, operates, and entrusts to third parties. Centrally manage internal assets through a cybersecurity platform or similar technology. Regularly confirm the status of assets operated by external providers. Visibility should include whether systems are internet-accessible, who has access privileges, and whether vulnerabilities are present. Attackers do not rely exclusively on unknown zero-day vulnerabilities.
Prioritize cyber risks. Once the security posture is visible, address the risks that matter most to the organization first. Priorities will differ across organizations and business units. They may include core IT systems whose outage would halt operations, internet-accessible public-facing systems that are highly exposed to attack, and databases that hold sensitive customer or employee information. Because no organization can eliminate every cyber risk at once, risks should be addressed in order of severity and business impact. Tools that present cyber risk clearly to nontechnical stakeholders can also support internal alignment and help engage executive leadership in an organization-wide response.
Treat cyber risks. Once priorities are set, begin with the highest-risk issues. Unpatched vulnerabilities in public-facing systems should receive particular attention, as should virtualization platforms, data centers, and other internal systems whose compromise could halt the business. Organizations should also build incident response capabilities around EDR and XDR so that signs of an attack can be detected and acted upon. Depending on their needs, they may also need arrangements for assistance from external security specialists and a review of their internal SOC or CSIRT structure.
The trends in this article reflect only what can be observed from publicly disclosed security incidents. They are a useful input when assessing cyber risk, but effective protection ultimately requires organizations to confront the actual security posture and cyber risk of their own systems and data. Some information assets may be managed independently by business units and therefore difficult for the security team to see. Incident trend data such as this can help security teams make the case for cooperation across the organization.
The malicious use of AI in cyberattacks
Finally, we consider what can currently be said about the relationship between malicious AI use and the many cyberattacks reported in Japan during September and October 2026.
Based on extensive underground research and cyberattack analysis, TrendAI™ assessed through 2024 that threat actors might be abusing AI. Beginning in 2025, TrendAI research identified clear evidence that threat actors were using it. Examples include malicious website source code generated with AI and prompts embedded in malware that instruct AI to write programs.
We cannot conclusively state that AI was directly used in the attack techniques behind the incidents reported in Japan during September and October 2026. However, in public-facing system incidents investigated by TrendAI, system logs showed the following signs.
Artifacts commonly left by AI-assisted programming: Deployed web shells and suspicious files contained commented-out text naming the targeted organization or service. A comment is a section of source code intentionally excluded from execution.
Use of information beyond conventional human best practices: The exploited vulnerabilities were not limited to recently disclosed, widely recognized “in-the-wild” vulnerabilities.
Rapid improvement after failure: The attackers reacted to failed attempts and adjusted their approach faster than has traditionally been observed.
Signs of searching for the shortest path: After identifying a target, the attackers appeared to use the responses they received to make focused attempts and quickly distinguish success from failure, instead of attacking comprehensively.
These signs do not prove that the attacks directly used AI. Nevertheless, the logs did capture behavior that differed from what had been observed previously. TrendAI will continue to share new information as investigations progress.
The malicious use of AI is likely to expand, but the importance of fundamental security controls remains unchanged. Organizations should use this opportunity to reassess the condition of their information assets and their exposure to cyber risk.