Japan faces rising cybersecurity threats to its national ID infrastructure | brief

Japan is grappling with a significant increase in data breaches targeting the ecosystem surrounding its My Number national identification system, according to a recent report by Biometric Update.

While the core My Number infrastructure remains uncompromised, the decentralized network of vendors, local governments and private firms supporting the program has faced numerous security failures. Between April 1 and Oct. 16, 2026, the Personal Information Protection Commission received over 2,000 breach reports, a sharp increase from the fiscal year. Attackers are increasingly utilizing artificial intelligence to identify vulnerabilities in shared cloud environments and unpatched systems. Notable incidents include a breach at a vendor managing appointment emails that exposed over 2 million addresses, and two separate intrusions into the Digital Agency itself, one of which involved a known VPN vulnerability. Experts argue that while the decentralized design prevents a single point of failure, it multiplies the number of targets, leaving the system vulnerable at its weakest points. In response, the government has launched an emergency cybersecurity package focusing on AI-assisted threat detection and improved intelligence analysis. However, critics suggest that the reliance on a single common identifier for diverse services, rather than sector-specific IDs, continues to heighten the risks associated with potential data exposure.

Source: Biometric Update