Japan Ransomware Cases Hit Record 123 in H1 2026 | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

Japan logged 123 confirmed ransomware cases between January and June 2026, the highest half-year total since the National Police Agency (NPA) began tracking the data in 2020, according to the Japanese report. The figure is up by seven cases compared with the same period a year earlier, and it lands at a moment when Japanese companies are already absorbing record losses from online fraud. The pattern points to a threat that has moved past the point of being an occasional headline and into something closer to a standing operational risk for firms across the country.

The NPA breakdown shows the damage was not confined to a handful of large targets. Of the 123 cases, 79 hit small and medium-sized enterprises, 31 struck large companies, and 13 involved organizations or similar entities, per the Japanese report. Cases were reported across 35 of Japan’s 47 prefectures, indicating the problem is geographically dispersed rather than clustered in Tokyo or Osaka alone. For a country whose economy runs heavily on small manufacturers, logistics firms, and regional suppliers feeding larger industrial chains, that spread matters: a ransomware hit on a mid-sized parts supplier can stall production lines well beyond the company that got breached.

The numbers behind Japan’s ransomware record

Six years of NPA half-year data now exist, and the first half of 2026 sits at the top of that run. The count crossed 100 confirmed cases for a six-month period, a threshold Japan had approached in prior years but not cleared this decisively. A rise of seven cases year over year sounds modest in isolation, but it comes on top of already-elevated 2025 totals, meaning the trend line has kept climbing rather than plateauing.

The organizational split is the most useful part of the data set for risk teams. Small and medium-sized enterprises accounted for 79 of the 123 cases, or roughly two-thirds of the total. That tracks with what ransomware researchers have documented globally for years: smaller firms tend to run leaner security teams, patch less consistently, and are less likely to have dedicated incident response retainers in place. Large companies made up 31 cases, a smaller share numerically but each incident at that scale tends to carry outsized supply-chain and reputational consequences. The remaining 13 cases hit organizations or similar entities, a category that in NPA reporting typically covers nonprofits, associations, and public-adjacent bodies that don’t fit cleanly into corporate size brackets.

Geographic reach across 35 prefectures reinforces that this isn’t a Tokyo-Osaka corridor problem. Japan’s manufacturing base runs through regional hubs in Aichi, Fukuoka, Hokkaido, and dozens of smaller industrial centers, and ransomware crews increasingly don’t care where a target sits as long as the network is reachable and the payout looks plausible. Attackers scanning for exposed remote access tools or unpatched VPN appliances don’t filter by prefecture.

Fraud losses climbed even faster than ransomware cases

The ransomware count wasn’t the only alarming figure in the same reporting window. Japan’s internet-enabled fraud losses hit 176 billion yen in the first half of 2026, up 45% year on year. That growth rate outpaces the ransomware increase by a wide margin, and it suggests Japanese cybercriminals and international crews targeting Japanese victims are diversifying their tactics beyond file encryption and into direct financial fraud, phishing-driven account takeovers, and business email compromise schemes.

Taken together, the ransomware and fraud figures describe a threat landscape that’s expanding on two fronts at once. Ransomware crews extort companies for data and operational disruption, while fraud operators drain individual accounts and business payment channels. Both trends draw on the same underlying weaknesses: credential reuse, unpatched internet-facing systems, and employees who click the wrong link under time pressure. A security team that only budgets for ransomware defense while ignoring fraud vectors, or vice versa, is covering half the exposure.

Why small and medium businesses carry two-thirds of the cases

The 79-case SME share deserves its own look because it explains a lot about how ransomware crews pick targets. Large enterprises in Japan, as elsewhere, have spent years building dedicated security operations centers, running regular penetration tests, and buying cyber insurance policies that mandate baseline controls. Smaller firms usually can’t justify that spend against thinner margins, even though many of them sit inside supply chains for automakers, electronics manufacturers, and logistics networks that depend on uninterrupted data flow.

That imbalance creates an attack-of-least-resistance dynamic. A ransomware affiliate scanning for exposed RDP ports or outdated VPN firmware doesn’t need to breach a major conglomerate directly if a smaller supplier feeding into that conglomerate’s operations offers the same disruption leverage at a fraction of the defensive resistance. Monthly ransomware tracking from BlackFog has repeatedly flagged this SME vulnerability gap as a structural, not incidental, feature of the current threat environment, and Japan’s first-half 2026 numbers fit that pattern closely.

The 31 large-company cases still matter disproportionately for the broader economy. A ransomware incident at a major manufacturer or logistics operator can halt production or delivery schedules that ripple through dozens of downstream partners, turning a single intrusion into a multi-company disruption event. That dynamic has played out in other markets already this year, where ransomware hits on logistics and healthcare operators triggered cascading delays well beyond the initial victim.

Half-year comparison: Japan’s ransomware trend since 2020

The NPA has now published six years of comparable half-year figures, giving analysts a longer baseline than most national police agencies can offer for this specific crime category. The table below lays out what’s confirmed for the current reporting period against the year-over-year change the Japanese report cites, alongside the fraud loss figure from the same six-month window.

The NPA’s data collection start point in 2020 means this is the sixth consecutive year of comparable reporting, which is long enough to distinguish a genuine trend from short-term noise. A single elevated half-year could be dismissed as an anomaly; six years of data culminating in a record high is harder to wave away. The available reporting doesn’t break down the SME, large-company, and organization splits for prior half-years, so a full apples-to-apples trend across all three categories isn’t yet public, but the topline case count trajectory is clear enough on its own.

How Japan’s ransomware exposure compares to global patterns

Japan’s first-half 2026 numbers sit inside a broader global ransomware environment that has kept expanding despite years of law enforcement takedowns and sanctions against major crews. Security vendors tracking leak-site postings and confirmed incidents worldwide have documented ransomware activity climbing through 2026, with monthly reports from firms including BlackFog and AhnLab’s ASEC threat intelligence team showing sustained attack volume across manufacturing, healthcare, and professional services sectors globally. Japan’s SME-heavy breakdown mirrors what researchers see in the US and Europe: smaller organizations absorb the bulk of incident counts, while a smaller number of large-enterprise hits generate the bulk of headline-grabbing ransom demands and downstream disruption.

Where Japan differs somewhat from Western markets is in ransom payment culture and public disclosure norms. Japanese corporate governance has historically leaned toward quiet incident handling rather than the more aggressive public disclosure regimes that US state breach-notification laws tend to produce. The FBI’s Internet Crime Complaint Center publishes similarly structured annual loss data for the US market, which makes NPA police-reported case counts, rather than public breach notifications, one of the more reliable indicators available for tracking the true scale of ransomware activity inside Japan, since not every incident surfaces through a public disclosure.

What’s driving the increase

The publicly available NPA figures don’t include a detailed root-cause breakdown of what’s pushing case counts higher, so any explanation has to stay grounded in what’s documented rather than speculating about specific attack vectors or named ransomware groups behind Japan’s cases. What is confirmed is the scale and distribution: more cases, spread wider geographically, with the SME segment absorbing the largest share. That distribution pattern is consistent with ransomware-as-a-service affiliate models that have proliferated globally, where access brokers and encryption toolkits are rented out to a wider pool of less sophisticated operators, expanding the volume of attempted intrusions even when any single actor’s technical skill level stays flat.

The parallel 45% jump in internet-enabled fraud losses suggests attackers operating against Japanese targets are working across multiple monetization paths at once rather than betting everything on ransomware extortion alone. A crew that gains initial access to a network might pivot toward data theft and fraud if encryption and ransom negotiation looks too slow or too likely to draw law enforcement attention, particularly as Japanese authorities and international partners have increased pressure on ransomware payment infrastructure over the past two years.

Sector exposure: manufacturing, logistics, and healthcare at risk

Japan’s economy runs on a dense web of manufacturing subcontractors, and that structure shapes where ransomware pressure tends to land hardest. Automotive parts suppliers, electronics component makers, and logistics coordinators sit in the SME bracket that absorbed 79 of the 123 first-half cases, and a single successful intrusion at any point in that chain can stall shipments to much larger assemblers downstream. Healthcare providers and regional hospital networks face a similar exposure pattern globally, where ransomware crews calculate that disruption to patient care creates faster pressure to pay than a typical corporate target would generate.

The available NPA data doesn’t publicly break the 123 cases down by industry sector, so any sector-specific claims beyond the organization-size split would go beyond what’s confirmed. What can be said is that the 35-prefecture spread makes it unlikely that any single industry cluster or regional economic zone escaped exposure entirely during the first half of the year.

Historical context: six years of NPA ransomware tracking

The NPA’s decision to start formal half-year ransomware tracking in 2020 came as Japan, like most industrialized economies, was absorbing the first wave of high-profile ransomware incidents that moved the crime from a nuisance category into boardroom-level risk. Since then, the agency has published a consistent half-year cadence that now gives researchers, insurers, and corporate security teams six full years of comparable data, available through the National Police Agency’s English-language portal. A record set in the first half of 2026, against that six-year backdrop, signals that whatever mitigation efforts Japanese companies and law enforcement have deployed over the period haven’t yet been enough to bend the case-count curve downward.

That’s not unique to Japan. Ransomware researchers globally have tracked similar multi-year growth trajectories in the US, UK, and across the EU, punctuated by occasional dips tied to major law enforcement takedowns of specific ransomware infrastructure, followed by rebounds as new affiliate groups or rebranded crews fill the gap left behind. Japan’s six-year data set now fits that same long-arc pattern rather than standing apart from it.

Market and insurance impact

A record ransomware half-year carries direct implications for Japan’s cyber insurance market, which has already been tightening underwriting standards in line with global trends. Insurers pricing policies for Japanese SMEs will likely weigh the 79-case SME figure heavily, since it confirms that smaller firms represent the largest volume of claims risk even if large-company incidents generate bigger individual payouts. Expect underwriters to push harder on baseline control requirements, such as mandatory multi-factor authentication and patch management attestations, before extending or renewing coverage for smaller Japanese policyholders.

The 45% jump in fraud losses adds a second pressure point for financial institutions and payment processors operating in Japan, who will need to weigh fraud-detection investment alongside ransomware-specific defenses. For corporate security budgets generally, the combined data set argues against treating ransomware and fraud as separate line items, since the underlying access methods (phishing, credential theft, unpatched remote access) frequently overlap between the two categories.

What Japanese companies can do now

Security researchers globally have converged on a fairly consistent baseline checklist for reducing ransomware exposure, and it applies directly to the SME segment carrying Japan’s heaviest case load. Multi-factor authentication on all remote access and email accounts closes off the credential-theft path that underpins a large share of initial intrusions. Regular, tested offline backups reduce the leverage a ransomware crew holds once encryption happens, since a company that can restore from backup has far less incentive to pay a ransom demand.

Patch management for internet-facing systems, particularly VPN appliances and remote desktop services, remains one of the highest-leverage defensive investments available, since a large share of ransomware intrusions globally trace back to known, unpatched vulnerabilities rather than novel zero-day exploits. Check Point’s ransomware protection guidance and Japan’s own JPCERT Coordination Center both point to the same short list of controls. For smaller Japanese firms without in-house security staff, managed detection and response services or regional information-sharing groups can substitute for the dedicated security operations centers that larger companies run internally.

Predictions for the second half of 2026 and beyond

Based on the trajectory in the confirmed data, a few outcomes look likely heading into the back half of 2026 and beyond, though these remain forward-looking assessments rather than confirmed facts:

• The full-year 2026 ransomware case count for Japan will likely exceed the 2025 total, continuing the multi-year upward trend the NPA’s six years of data have tracked since 2020.
• Small and medium-sized enterprises will probably continue to represent the majority of confirmed cases, keeping pressure on Japan’s cyber insurance underwriters to tighten SME policy terms.
• Internet-enabled fraud losses, already up 45% year on year in the first half, are likely to keep climbing at a faster percentage rate than ransomware case counts through the remainder of 2026.
• Japanese regulators and industry groups will likely face growing pressure to publish more granular sector-level breakdowns of ransomware data, given how much analysis currently has to stop at the organization-size level.
• Expect continued cross-border coordination between Japanese authorities and international law enforcement partners targeting ransomware payment infrastructure, following the pattern set by takedowns affecting ransomware groups operating against US and European targets.

Frequently asked questions

How many ransomware cases did Japan record in the first half of 2026?
Japan’s National Police Agency recorded 123 confirmed ransomware cases between January and June 2026, according to the Japanese report, the highest half-year figure since the agency began tracking the data in 2020.

Is this an increase from the previous year?
Yes. The first-half 2026 total of 123 cases is up by seven cases compared with the same period a year earlier.

Which businesses were hit hardest?
Small and medium-sized enterprises accounted for 79 of the 123 cases, the largest share, followed by 31 cases at large companies and 13 at organizations or similar entities, per the Japanese report.

How widespread were the cases geographically?
Cases were reported across 35 of Japan’s 47 prefectures, indicating the problem extended well beyond major metropolitan centers.

Did online fraud losses also increase in Japan?
Yes. Internet-enabled fraud losses reached 176 billion yen in the first half of 2026, up 45% year on year, according to the same reporting set.

How long has Japan’s National Police Agency tracked ransomware data?
The NPA has collected half-year ransomware statistics since 2020, giving six years of comparable data through the first half of 2026.

What can smaller Japanese companies do to reduce ransomware risk?
Baseline steps recommended by security researchers globally include enabling multi-factor authentication on remote access and email, maintaining tested offline backups, and prioritizing patches for internet-facing systems such as VPN appliances, since unpatched known vulnerabilities remain a common entry point for ransomware intrusions.

Does the NPA data name specific ransomware groups behind the first-half 2026 cases?
The publicly available figures cited in this report do not break down cases by specific ransomware group; that level of detail is not confirmed in the available record.

Related Coverage