TOKYO — Japan has unveiled an emergency cybersecurity package worth 10 billion yen (about $63 million), creating a new public-private “cyber rescue team” and expanding the use of artificial intelligence to hunt for weaknesses in government systems, after a wave of breaches that exposed the data of hundreds of thousands of people.

The package was approved on Friday, November 6, 2026, at a ministerial meeting chaired by Prime Minister Sanae Takaichi. It is the government’s most direct response yet to a run of unauthorised access and data leaks that has hit dozens of companies and government agencies across the country.

Key Points

• Japan announced an emergency cybersecurity package on Friday, November 6, 2026, approved at a ministerial meeting chaired by Prime Minister Sanae Takaichi.
• The package starts with 10 billion yen (about $63 million) from fiscal 2026 reserves, with Takaichi directing ministers to secure further funding.
• A public-private “cyber rescue team” will give attacked companies an initial response, and a specialist “top gun” team will use AI to find system weaknesses by the end of November.
• The government will expand “active cyber defense” to access servers used by hackers, and infrastructure operators must report attacks within hours.
• The breach wave includes NTT Docomo’s disclosure that customer data tied to as many as 294,839 mobile lines was exposed, and at least 81 incidents reported since July.

What Happened

The emergency package was drawn up after months in which Japanese companies and public bodies reported intrusion after intrusion. Dozens of companies and government agencies have suffered unauthorised access and data leaks, and the new measures are designed to stop the next attack rather than simply clean up after it.

The first tranche, 10 billion yen from fiscal 2026 reserves, is split three ways: 2 billion yen for AI-assisted vulnerability checks of important government systems, 4.1 billion yen for police cybersecurity equipment and training, and 3.8 billion yen to strengthen the Digital Agency’s systems. Takaichi directed ministers to secure further funding, signalling the 10 billion yen is a starting point rather than a final figure.

Background and Context

At least 81 incidents have been reported since July, about a third of all attacks recorded in Japan over the past three years. The most serious disclosure came from NTT Docomo, Japan’s largest mobile carrier, which said customer data tied to as many as 294,839 mobile lines was exposed, including identity-document numbers and bank account details.

Japanese media have reported that a Chinese AI cybersecurity tool called Artex was used in several of the hacks, although the government has not attributed the wave to any single actor. The package also builds on a law passed in October that legalised “active cyber defense”, allowing the authorities to take a more assertive approach against the infrastructure attackers use.

The Japan Cybersecurity Package in Detail

At the heart of the Japan cybersecurity package are two new teams. The public-private “cyber rescue team” will give companies hit by attacks an initial response in the critical hours after a breach is discovered — vital for smaller firms with no in-house security staff. The specialist “top gun” team at the Ministry of Economy, Trade and Industry, due by the end of November, will use AI to find weaknesses in systems, working with technology companies and AI developers in friendly countries.

The package also tightens the rules for operators of core infrastructure, who must now report attacks to the National Cybersecurity Office within hours rather than days, so the government can see the shape of an attack while it is still unfolding and warn other potential targets.

Reactions and Quotes

The government has presented the package as an emergency measure for an emergency situation, and Takaichi chairing the ministerial meeting herself shows the issue has reached the top of the political agenda. Her instruction to ministers to find more money suggests the cabinet expects the threat to grow rather than fade.

Attention has also focused on media reports linking the Chinese AI tool Artex to several of the hacks. The government has not confirmed that link and has not blamed any single actor, leaving attribution open while the new teams and reporting rules take shape.

Why It Matters

For ordinary people in Japan, the stakes are personal. The Docomo breach exposed the kind of details — identity documents and bank accounts — that can be used to open accounts, take out loans or impersonate victims. A package that prevents the next breach matters more than one that simply punishes the last attacker.

For the government, the package is a test of whether Japan can move at the speed of the threat. The 81 incidents reported since July show attackers finding targets faster than defenders are closing gaps, and the use of AI on both sides means the contest is accelerating. A rescue team and a top gun team are attempts to match that pace.

For the region, Japan’s response will be watched closely, and the move comes as the cybersecurity industry consolidates around AI: CrowdStrike agreed to buy two AI security startups in a reported $495 million deal.

What Happens Next

The most immediate deadline is the end of November, when the “top gun” team is due to be up and running. Its first task will be AI-driven hunts for weaknesses in the systems that matter most, and its early findings will show whether the approach can deliver results quickly. Ministers will also be working on the further funding Takaichi ordered; the initial 10 billion yen is modest next to the scale of the threat.

The new reporting rules will take effect alongside the teams, and investigations into the breach wave continue. Whether the government eventually attributes the campaign, and to whom, could shape Japan’s diplomatic response as much as its technical one.

Frequently Asked Questions

What is Japan’s emergency cybersecurity package?
A package announced on Friday, November 6, 2026, starting with 10 billion yen (about $63 million). It funds AI vulnerability checks, police cybersecurity equipment and training, and stronger Digital Agency systems, and creates a “cyber rescue team” and a “top gun” team.

Why did Japan announce it now?
Dozens of companies and government agencies have suffered unauthorised access and data leaks, with at least 81 incidents reported since July. The most serious disclosure came from NTT Docomo, with data tied to as many as 294,839 mobile lines exposed.

What is the “cyber rescue team”?
A new public-private team that gives companies hit by cyberattacks an initial response in the hours after a breach is discovered.

What is “active cyber defense”?
A more assertive approach to cyber defence that Japan legalised in October 2026, allowing the authorities to access servers used by hackers. The new package expands its use.

Who is behind the attacks?
Japanese media have reported that a Chinese AI tool called Artex was used in several of the hacks, but the government has not attributed the wave to any single actor.