As Incidents Rise, Japanese Government’s Cybersecurity Falls Short

As Incidents Rise, Japanese Government’s Cybersecurity Falls Short

Summary

Japan is seeing a sharp rise in cyber incidents while many critical government systems remain poorly managed. The Board of Audit found 58 of 356 designated critical systems lacked appropriate security controls, and 259 systems (73%) had no business continuity plans. At least 447 cybersecurity incidents were reported in 2024 — more than double the prior year — affecting both commercial and government targets.

Nation‑state actors (notably Chinese APTs and DPRK’s Lazarus Group) and cybercriminals have been active against Japan. Examples include the extended MirrorFace espionage campaign, Cobalt Strike implants deployed via PHP CGI flaws, and a significant breach at NTT Communications. In response Japan has strengthened offensive authorities via the Active Cyber Defence law and stepped up international threat‑sharing, but experts say defensive posture, visibility and automation still lag.

Key Points

• The Board of Audit found 58 critical government systems without adequate security controls and 259 systems lacking business continuity plans.
• Reported cyber incidents rose to at least 447 in 2024, more than double the previous year.
• Major threats include Chinese APT groups and North Korea’s Lazarus Group; campaigns like MirrorFace likely caused critical data loss.
• Attack vectors observed include exploitation of PHP CGI flaws and deployment of Cobalt Strike, targeting multiple sectors.
• Japan passed the Active Cyber Defence law to allow active measures, require incident reporting and enhance traffic interception under oversight.
• Experts urge a shift from siloed, product‑focused security to broader attack‑chain visibility, automation and AI‑assisted defences.

Why should I read this?

Quick heads‑up: Japan’s getting hammered online and some government systems are exposed. If you work in security, run critical services or care about regional stability, this matters — and it’s got practical lessons you can nick to shore up your own setup.

Author style

Punchy: this is urgent — national security and critical services are at stake. Read the detail if you want the full picture and practical takeaways.

Source

Source: https://www.darkreading.com/cyber-risk/japanese-governments-cybersecurity-falls-short