As Incidents Rise, Japanese Government's Cybersecurity Falls Short

The Japanese government suffered the most cybersecurity incidents in 2024, with 447 incidents reported, more than double the previous year. The Board of Audit identified 58 critical systems at a dozen government agencies that lacked appropriate security controls and management, and it found that 259 of the 356 critical systems had no business continuity plans in place (73%).

Stronger offensive capabilities are underway, with the Active Cyber Defense Law passed in May to allow authorities to monitor and intercept foreign Internet traffic and to enable a Cyber Council linking government agencies with private partners. The findings come as the country faces increased cyberattacks from nation-state actors and cybercriminals, including campaigns such as MirrorFace targeting policy experts, politicians, and academics.

Earlier, analysts noted that a vulnerability in PHP CGI on Windows systems in Japan allowed intruders to install Cobalt Strike proxies, and Trend Micro notes that Lazarus Group and other Chinese and North Korean actors have targeted Japan. According to the Center for Cybersecurity Policy and Law, the law marks a pivotal shift in Japan’s cybersecurity strategy, while officials emphasise the need to move beyond siloed security and adopt more proactive, surface‑level visibility and automation.