Japan Faces Record Ransomware Attacks in H1 2026

In the first half of 2026, Japan recorded a staggering 123 ransomware attacks, the highest since data collection began in 2020. The National Police Agency (NPA) reported an average of 13,687 suspicious access attempts per IP address daily, marking a significant increase from the previous year. Small and medium-sized enterprises were the primary targets, accounting for 79 of the attacks, while 31 targeted large corporations. The manufacturing sector was the most affected, with 37 cases reported. Recovery from these attacks often exceeded a month and incurred substantial costs, with over half of the cases resulting in significant operational disruptions. The NPA has developed a tool that successfully recovered 20.11 million files from ransomware, which has also been shared with Europol for international use. Additionally, phishing emails decreased to 731,000, with China identified as the main source. The police also dealt with 127 business email scams, leading to losses of approximately 3.88 billion yen. Overall, the NPA managed 7,607 cybercrime cases in the first half of 2026, a rise of 982 cases from the previous year.

Key Points: • Japan reported a record 123 ransomware cases in H1 2026. • 79 attacks targeted small and medium-sized companies, with manufacturing being the most affected sector. • The NPA recovered over 20 million files from ransomware attacks using a specialized tool.