Amid a series of unauthorized access incidents and customer information leaks at financial institutions, the Financial Services Agency (FSA) has requested all financial institutions to thoroughly implement cybersecurity measures and to review and tighten identity verification procedures. Behind this lies a rapid increase in attacks exploiting generative AI and supply chain vulnerabilities, as well as the limitations of traditional perimeter defenses.

1-1. The Reality of Damage from Unauthorized Access and Data Breaches Spreading Across the Entire Financial Sector

In October 2026, major securities firm Daiwa Securities announced that customer information for approximately 110,000 individuals (including names and account numbers) may have been leaked due to unauthorized access to a contractor’s server. Beyond this, large-scale incidents across various industries have occurred successively, such as the leakage of about 120,000 records at Dai-ichi Life and up to approximately 6.6 million account member records at car-sharing service Times Car (including driver’s license images for about 1.6 million accounts). The spread of damage has expanded not only to mega-banks, regional banks, and savings banks, but also to internet banks, insurance companies, securities firms, and even fintech online investment-linked financial service providers. IP addresses identified by authorities such as the Financial Supervisory Service as likely used in the attacks total 28, excluding duplicates, and have been found to be dispersed across 12 countries including the United States, Japan, Hong Kong, Singapore, and Germany. According to National Police Agency statistics, the number of ransomware damage reports for the first half of 2026 (January to June) reached a record high of 123 cases for a half-year period, with small and medium-sized enterprises accounting for approximately 60% of them. Attacks targeting the entire financial sector, which serves as a social infrastructure, are becoming increasingly active, and the impact on the economic and social system as a whole is growing more serious.

1-2. Emergency Request for Countermeasures by the Financial Services Agency and the National Police Agency and Strengthening of the Investigation System

In response to the growing scale of damages, the Financial Services Agency (FSA) issued an alert on October 9, 2026, urging all financial institutions and related entities to strengthen cybersecurity measures and review and tighten identity verification procedures. Specifically, it instructs the inspection of third-party risks, including external contractors; the establishment of emergency response systems in the event of incidents; and the identification of and immediate response to vulnerabilities in externally exposed IT assets. Furthermore, noting that forgery and impersonation techniques using generative AI and other tools are becoming increasingly sophisticated in non-face-to-face customer transactions, the agency requested thorough checks for anomalies in identity verification documents and facial images. Moreover, in light of the revision to the Ordinance for Enforcement of the Act on Prevention of Transfer of Criminal Proceeds—which will abolish identity verification via the transmission of document images starting in April 2027 and generally make the reading of IC chip information from My Number cards and other documents mandatory—the FSA is urging institutions to implement these measures as quickly as possible without waiting for the enforcement date. The National Police Agency’s National Investigation Headquarters also formed a 28-member dedicated team (such as the Cyber Terrorism Investigation Division) and launched a full-scale investigation on suspicion of violating the Information and Communications Network Act and other charges.

2. Structural Vulnerabilities Leading to Widespread Damage and the Sophistication of Attacks

2-1. Security Blind Spots Lurking in Contractors and Supply Chains

As a structural cause behind the recent string of unauthorized access incidents, “vendors and supply chains” with weaker security than a company’s own systems are being used as footholds for attacks. In the case of Daiwa Securities, the target of the attack was the server of a company entrusted with customer inquiry management operations, rather than a direct intrusion into Daiwa Securities’ core system itself. Currently, many financial institutions rely on external service providers for the partial development of core banking systems, customer support (BPO), authentication infrastructure, SaaS, and cloud services. However, it is extremely difficult for companies to understand and manage the security status of not only their primary contractors, but also subsequent subcontractors (4th parties) and commonly used platforms. As pointed out in the principles of the Basel Committee on Banking Supervision and the guidelines of the Financial Services Agency, while operational responsibilities can be transferred by outsourcing tasks, the social impact and resulting losses from system outages, as well as accountability to customers and regulatory authorities, cannot be transferred to vendors. Thorough ledger maintenance and risk assessment encompassing the entire supply chain are indispensable.

2-2. Accelerated Attacks via Generative AI Abuse and the Risk of “Excessive Data Retention”

The sophistication of attack methods and the management challenge of “excessive data retention” on the defensive side are also major factors that amplify the scale of damage. In recent cyberattacks, generative AI such as ChatGPT and Claude Mythos has been weaponized, enabling even attackers without specialized knowledge to automatically generate sophisticated malware and scan and analyze vulnerabilities in exposed systems at ultra-high speeds. Consequently, rather than conventional phishing using unnatural language, sophisticated attacks utilizing meticulously crafted spoofed emails and deepfake videos are surging, drastically shortening the window of time for defenders to apply patches or implement blocks. Meanwhile, on the defense side, the risk of “holding too much”—leaving data from canceled users and information on employees who retired decades ago lingering within systems—has become apparent. In incidents involving Times Car and Dai-ichi Life, historically stored data was also compromised, highlighting the critical importance of strictly enforcing data minimization to promptly delete personal data once its purpose has been fulfilled, as well as implementing encryption (such as data encryption platforms like D.AMO) that renders data unreadable even in the event of a breach.

3. Guideline Revisions and Future Risk Management to Be Implemented by Financial Institutions

3-1. Establishment of a Management-Led Control Framework Based on Financial Services Agency Guidelines

In the “Guidelines on Cybersecurity in the Financial Sector,” established by the Financial Services Agency on October 4, 2024, cybersecurity measures are defined not merely as operational issues for the IT department, but as a paramount management issue that dictates business continuity and the stability of the financial system. These guidelines require, under the proactive commitment of management, the allocation of clear authority and budget to the CISO (Chief Information Security Officer), as well as the introduction of a “risk-based approach” suited to the organization’s risk tolerance. Furthermore, the revised Internal Control Reporting System (J-SOX) mandates the securing of IT security as a fundamental element of internal controls, requiring substantive risk assessments rather than mere formal checklist submissions. Specifically, essential response measures include ensuring immutable backups for accounting systems and core data, formulating business continuity plans (BCP) assuming system outages due to ransomware or similar attacks, and conducting regular recovery drills.

3-2. Future Outlook and Fundamental Defense Strategies Required of the Financial Industry

In future cyber defense within the financial sector, it is essential to move away from the perimeter-defense mindset and introduce multi-layered defense based on the assumption of system intrusions, along with access control grounded in the “Zero Trust” philosophy. Financial institutions must constantly keep comprehensive management ledgers (including the use of SBOMs, etc.) up to date—covering not only their own IT assets but also outsourced vendors and cloud infrastructure—and promptly complete patch applications for publicly disclosed vulnerabilities as well as the implementation of multi-factor authentication (MFA). Furthermore, they are required to continuously sharpen their detection and initial response capabilities through the sharing of real-time threat intelligence via collaboration with financial ISACs and relevant government ministries, as well as the periodic implementation of threat-led penetration testing (TLPT) that mimics the latest methods of attackers. As the speed and volume of attacks dramatically increase in the generative AI era, financial institutions are expected to go beyond individual company responses to deepen mutual assistance systems across the entire industry, and to promote drastic security strategies aimed at maintaining customer trust and establishing sustainable digital trust.

Reference Page

• [Guidelines on Cybersecurity in the Financial Sector (Financial Services Agency)] https://www.fsa.go.jp/

【#Cybersecurity #UnauthorizedAccess #FinancialServicesAgency #ThirdPartyRisk #PrivacyProtection #RiskManagement #EconomyAndBusiness】