How does a country know it has a ransomware problem? In Japan’s case, by counting. In its Thursday release, the National Police Agency confirmed 123 ransomware incidents on Japanese soil during the January-to-June 2026 window — a six-month record since comparable counting began in 2020, and seven above the level posted a year earlier. The high-water mark lands in the same stretch in which internet scams have taken a record toll on Japanese wallets, pointing to a threat that has hardened from occasional headline into standing operational risk.
Where The Cases Actually Landed
The breakdown is the intriguing part. Small and medium-sized enterprises absorbed 79 of the 123 incidents — roughly two-thirds of the whole, mirroring what researchers see in the United States and Europe. Another 31 struck large companies, about a quarter of the count, while 13 landed on organizations and comparable bodies such as associations. Geographically, incidents surfaced in 35 of Japan’s 47 prefectures, so this is not a Tokyo-Osaka corridor problem; attackers scanning for exposed remote access or unpatched VPN appliances do not filter by prefecture.
The SME weighting is not an accident of chance. As the analysis of the data notes, smaller operators usually field thinner security staff, patch on a slower cadence and seldom keep incident-response help on call — even though many sit inside supply chains feeding automakers, electronics manufacturers and logistics networks. Intriguingly, that makes a mid-sized parts supplier the efficient target: the same disruption leverage as a conglomerate, at a fraction of the defensive resistance. A single intrusion can freeze deliveries to the far bigger manufacturers sitting downstream, which is why the 31 large-company incidents still carry outsized ripple effects despite their smaller count.
The Fraud Number Climbing Faster
Ransomware was not the only record. Internet-based scams drained 176 billion yen from Japanese victims across the opening six months of 2026, a 45% jump against the previous year — a growth rate that dwarfs the seven-case ransomware rise. What researchers found in pairing the two figures is a diversifying attacker: crews monetize access through encryption and ransom on one path, and through account takeovers driven by phishing plus business email compromise on the other, both feeding on the same weaknesses of credential reuse and unpatched systems.
Kyodo’s account of the same data adds the reconnaissance layer: police-monitored internet connection points logged an average of 13,687 suspicious-access attempts a day for every IP address — itself a record, and over 4,000 higher than a year earlier — the preparatory scanning that precedes attacks like these.
Six Years Of Data, One Direction
The science behind trend-watching says single spikes lie; runs do not. The NPA’s series of comparable half-year figures now spans six straight years, and the 2026 opening half tops every entry in it, pushing decisively past the 100-case threshold within a single six-month span. The prior-year splits by company size are not published, which leaves any apples-to-apples trend across categories out of reach — but the topline trajectory alone is hard to wave away.
What is driving the climb? The agency publishes no root-cause breakdown, and honest analysis stops at what is documented: more cases, spread wider, SMEs absorbing the most. That distribution fits the ransomware-as-a-service model, where access brokers rent toolkits to a widening pool of less skilled operators, lifting attempt volume even when no individual actor gets cleverer.
For Japan specifically, disclosure culture shapes the counting. Corporate governance there has long favored handling incidents quietly, so police-reported case counts — not breach notifications — are among the more reliable gauges of true scale. By that gauge, the record is now official, and the supply chains behind it are the reason it matters.
Sources
- Japan Ransomware Cases Hit Record 123 in H1 2026
- Ransomware attacks in Japan hit record 123 cases in 1st half of 2026
