A spate of cyberattacks that has rocked Japan Inc. in recent weeks is alarming not because of some novel artificial intelligence hacking methods, but the sheer scale.

The head of the ruling Liberal Democratic Party’s cybersecurity body went so far as to describe it as a “state of emergency in cyberspace.”Brokerage firm Daiwa Securities Group Inc., SoftBank Corp.’s cloud subsidiary IDC Frontier, railway operator JR East, convenience-store chain Lawson, car-rental platform Times, and even a major karaoke operator and grilled meats restaurant chain have all been affected. It’s been hard to keep track of the barrage of incidents.

Publicly disclosed breaches, mostly impacting customer data, through September surpassed the total for all of last year, according to Tokyo-based cybersecurity firm Trend Micro Inc. And while ransomware attacks globally slid by 3% between July 2025 and June 2026, according to Microsoft’s Digital Defense Report published this month, they surged 67% in Japan. This is likely only the tip of the iceberg.

I’ve been warning that this could happen in Japan for a while. Now Qilin, the notorious Russian-speaking cybercrime group that claimed responsibility for last year’s attack on beermaker Asahi Group Holdings Ltd., told local broadcaster JNN last week that attacks on Japanese companies and government agencies were likely to increase. “That is not a threat, but our expert opinion,” the group added, claiming that Japan has one of the worst computer security systems in the world.

Breaches impacting karaoke joints and barbecue chains might not get the same headlines as the looming threat of rogue agents misbehaving. Yet Japan’s deluge shows how new AI tools have made it easier and cheaper for bad actors to find and exploit older security holes and automate the process. The president of Tokyo-based cybersecurity firm S&J Corp. described the results to Reuters as a “carpet-bombing” from a machine that never tires.

Many in the AI industry have shifted the safety debate to supposedly existential threats while the more immediate harms proliferate in plain sight. If governments and AI companies can’t use the technology to defend against easily exploitable weaknesses, there’s little reason to trust that they’ll coordinate effectively against future dangers. What’s happening in Japan is an early test for the rest of the world.

Tokyo, to its credit, is treating this as an extremely urgent problem and convened a cross-ministry meeting last Friday to respond. Finance Minister Satsuki Katayama urged financial institutions review defenses immediately, and the government separately said it was warning roughly 1,000 industry groups to do the same. Yet some of the official guidance still feels surprisingly surface level, including checking logs for abnormalities, patching vulnerabilities, and re-examining what data needs to be stored. It hardly feels like a comprehensive strategy in the AI era.

The government has also ramped up standards, especially around critical infrastructure, and large companies are more likely to harden systems. Yet small and medium-size businesses account for roughly 99% of firms. Some 70% lacked adequate cybersecurity defense systems, a Ministry of Economy, Trade and Industry survey found. They could be viewed as easy prey to disrupt the vast supplier networks that prop up Japan Inc.

Tokyo has long been aware of cybersecurity talent shortages that leave Japan vulnerable. Yet it’s clear that it needs a much more sustained push into training and investment. The government must make cyber resilience as basic and standardized as natural disaster preparedness, responding as it would to any other emergency.

This is far from a Japan problem. South Korea spent the past week reeling from cyberattacks on major banks and even megachurches. US-based Crowdstrike said that the attacks on the banks likely came from a financially motivated actor using a Chinese agentic AI tool and Anthropic PBC’s Claude Code. Australia said last month that an OpenAI agent gained unauthorized access to a government health portal, becoming the latest in a growing list of hacking incidents involving rogue systems. The cross-border nature of these threats makes timely information sharing between governments and the private sector increasingly urgent.

AI companies also have a role to play. If their products are dramatically lowering the cost and expertise required to conduct cyberattacks, they should help with preventing abuse and provide tools and training for defenders. Fighting AI-supercharged attacks with legacy IT defenses is untenable. Governments should push to accelerate the adoption of such security systems, particularly among under-resourced companies.

For now, attackers in Japan have mostly come after customer data; I’ve long assumed nothing I put into a karaoke app is safe. But they won’t stop there, and the rest of the world shouldn’t expect the threat will stay contained.