On 6 November 2026, Prime Minister Sanae Takaichi announced an emergency cybersecurity package after a run of breaches at Japanese companies and government bodies. The Prime Minister's Office record of the second Ministerial Meeting on Cybersecurity says about ¥10 billion was allocated from reserve funds that morning. The package has four pillars: thorough basic measures including the use of AI, stronger information-gathering and analysis, strategic responses to attacks, and better victim support. The Associated Press adds that METI will assemble a "top gun" expert team by the end of November, and that public-private "cyber rescue teams" will give initial help to companies that have been hit.
The package arrived just as the breach that best illustrates the problem was becoming clear.
The strongest case for the package
The case for acting fast is real. Japan has had months of incidents, and The Record describes a country "reeling from dozens of cyber incidents." Small and mid-sized firms often have no incident-response retainer, no forensic capacity and no contact at a regulator. A rescue team that arrives within hours addresses a real market gap. So does the reporting rule Takaichi is asking for. She wants reports from core infrastructure operators to reach the National Cybersecurity Office "within a few hours if possible, and at least within the same day." Fast reporting helps defenders across the whole economy, and it deserves support.
The package also has an institutional base. The National Cybersecurity Office says the Cybersecurity Capability Enhancement Act and related legislation were enacted in May 2025, that the old NISC was reorganised, and that the NCO was established in July 2025. It also says Japan's Common Cybersecurity Standards for Critical Infrastructure entered into force on 1 October 2026. The AP says the active cyber defence powers were "legalized in October". That is ambiguous, because the NCO dates the enabling legislation to May 2025. We could not find a primary source for the exact commencement date of the active-defence provisions, so we don't assert one.
What Arara shows
On 13 November the City of Osaka said more than 1 million email addresses were exposed through the Arara email distribution service. Arara is used by TKC Corporation, which maintains the city's online administrative services platform. Per The Record, anyone who received an email from the city's system between July 2026 and 31 October had their address leaked. The city told its 2.8 million residents to be wary of suspicious emails.
The wider damage came from one vendor. Arara said a 2 November attack exposed 77 million email addresses from nearly 400 customers, including TKC and Sega. Attackers then used Arara's own distribution service to send millions of phishing emails posing as credit-card companies and financial institutions. Osaka Prefecture separately disclosed a breach affecting food-support participants.
This was a single point of failure. One mail-delivery provider sat inside the trust relationships of hundreds of organisations. Each of those organisations had given it a list of customers and a sending identity that recipients trust. The victims' own security was largely beside the point. A top-gun team or rescue squad can't undo a sending reputation that has already been used for phishing, or recall addresses that have already left.
Where the package is thin
The announced measures are mostly about the response after an incident: experts, AI tooling, rescue teams and faster reporting. These are useful, but they mainly move the point of intervention to after the damage. Three gaps stand out.
- Vendor concentration is not addressed. Nothing announced so far targets the dependence of public bodies and large companies on a handful of bulk-communications suppliers. Procurement baselines are the proportionate lever here. Governments can require minimum security controls, data minimisation, breach notification clauses and exit plans from vendors they pay. This steers behaviour without writing a new compliance regime for every company.
- Data minimisation is absent. An email list is only a high-value target if it is retained, centralised and re-used. A vendor that holds addresses for hundreds of clients for months is an obvious prize. Retention limits and ephemeral sending would shrink what any single breach can expose.
- Fast reporting needs a safe harbour. Same-day reporting only works if firms trust that disclosure won't trigger punitive enforcement for the victim. Japan should say plainly that timely, good-faith reporters get leniency. Otherwise firms will report late or incompletely, and the data the NCO needs will be worse.
The speech and innovation angle
Active cyber defence authorities, under which officials can access and neutralise attacker infrastructure, raise legitimate concerns about secrecy of communications under the Japanese Constitution. Those concerns have been raised about the framework since its passage. Takaichi's package leans on those powers while the independent oversight arrangements are still new. A government that wants public trust for expanded access to servers should publish how often powers are used and how oversight is applied. Transparency here costs little and protects the legitimacy of the whole programme.
On innovation, the AI-based defence the package promises is a good bet if it is procured competitively and tested against real incidents. It would be a poor one if it becomes a showcase project that crowds out private security firms. The rescue-team model, which pairs public and private experts, points in the right direction. It should have open participation standards, so smaller Japanese security firms can take part and not only the largest incumbents.
A proportionate path
Japan has moved quickly, and the response is not wrong. But the 6 November package and the Arara incident, a week apart, point at different problems. The package is built for an attacker who breaks into a company. Arara was an attacker who broke into a supplier trusted by hundreds of companies, and the harm landed on millions of people who had never heard of it. The next step should be modest and evidence-led: baseline procurement security standards for suppliers to government, retention limits on bulk contact data, a clear safe harbour for early reporting, and public reporting on how the new powers are used. These cost far less than new licensing regimes, and they address the way this attack actually worked.