TOKYO, September 10 — Japan’s National Police Agency has reported a record number of ransomware cases in the first half of 2026, alongside a striking surge in suspicious access attempts at police internet connection points. The agency said Thursday that 123 ransomware cases were reported in the six months to June, the highest half-year tally since it began compiling such statistics in the second half of 2020.
Suspicious access at police internet connection points averaged a record 13,687 attempts per IP address per day — a figure that rose by more than 4,000 compared with the same period a year earlier. Such probing, the agency noted, is often conducted in preparation for cyberattacks.
Who is being hit
Small and medium-sized companies bore the brunt. Of the 123 reported cases, 79 targeted SMEs, 31 targeted large corporations, and 13 targeted other types of organizations. By sector, manufacturing accounted for the most cases at 37.
Recovery was neither quick nor cheap. The agency said recovery often took over a month, with virtual private network equipment the most common infection route — a detail that points to how attackers are getting in.
VPNs are the digital doorways that let remote workers into a company’s private network. If one is left unpatched or poorly configured, it becomes a way past the perimeter defences that would otherwise stop an intruder.
A tool that gives data back
There is a countermeasure worth watching. The agency has recovered 20.11 million files using a tool it developed to restore data encrypted by ransomware, and has provided that tool to the European Union Agency for Law Enforcement Cooperation, or Europol, for use worldwide. Separately, police issued 50,213 warnings in replies to social media posts suspected of recruiting people for illegal part-time jobs, up 14,576 from a year earlier.
The agency is advancing efforts to use artificial intelligence for detection and warnings. Phishing emails designed to steal credit card numbers and other information totaled 731,000, down 465,000 from a year earlier.
An analysis of phishing emails over the past year found China was the biggest estimated source at 45 percent. Police confirmed 127 cases of business email scams, in which perpetrators impersonate executives to convince corporate employees to make transfers, with losses totaling about 3.88 billion yen (about US$25 million). Unauthorized online banking transfers totaled 253 cases, with losses of around 2.07 billion yen (about US$13.4 million).
Police also took action in 7,607 cybercrime cases, up 982 from a year earlier, of which 1,945 were related to money laundering. The figures underline the growing severity of cyber threats facing Japanese businesses and public institutions.
What to watch next: whether the record pace of ransomware reports continues into the second half of the year, and whether the agency’s recovery tool — now in Europol’s hands — can blunt the damage when attackers do get through.
