The Financial Services Agency (FSA) has asked financial institutions nationwide to conduct emergency inspections of their security systems and strictly enforce identity verification as a response to a series of unauthorized access incidents and cyberattacks exploiting AI technology. Behind this move lies the frequent occurrence of large-scale data breaches through third-party vendors and the risk of increasingly sophisticated attacks driven by generative AI.

The Full Picture of the Emergency Warnings and Inspection Requests Issued in October 2026

On October 9, 2026, the Financial Services Agency (FSA) issued an emergency advisory urging all financial institutions and related entities to strengthen cybersecurity measures and to review and tighten identity verification procedures for various transaction applications. On the same day, the National Cyber Security Operations Unit (NCO) of the Cabinet Secretariat, the Ministry of Economy, Trade and Industry (METI), the Information-technology Promotion Agency (IPA), along with the National Police Agency and JPCERT/CC, simultaneously published similar warnings, marking an exceptional situation in which public institutions are coordinating to defend critical infrastructure. In this request, the FSA instructed the management of each financial institution to exercise leadership and promptly implement third-party risk management, emergency response frameworks in the event of incidents, and the identification of vulnerabilities in externally exposed IT assets. Additionally, to prevent the use of forged documents and identity spoofing in non-face-to-face transactions, institutions are asked to re-examine identity verification document images and facial photographs for any unnatural anomalies. Behind the authorities—led by the FSA—issuing such far-reaching requests lies the reality that indiscriminate attacks on society’s financial infrastructure have become an everyday occurrence. The following diagram illustrates the sequence of this series of advisories.

A Series of Unauthorized Access Incidents and the Expanding Reality of Damage

The direct trigger for the emergency request was a series of large-scale data breaches at financial institutions and related businesses leading up to the autumn of 2026. At major brokerage Daiwa Securities, it was revealed that the server of a vendor entrusted with customer inquiry management had been accessed without authorization, potentially leaking customer information for approximately 110,000 individuals. Furthermore, Dai-ichi Life Insurance experienced a leak of data for about 120,000 people from its internal employee HR system, while major car-sharing service Times Car suffered a breach affecting up to approximately 6.6 million member accounts and roughly 1.6 million driver’s license images. The impact is not limited to megabanks, regional banks, online banks, insurance companies, and securities firms, but has also spread to fintech operators. According to National Police Agency statistics, reported ransomware incidents in the first half of 2026 (January–June) reached 123, marking a record high for any half-year period. The IP addresses used in these attacks are distributed across more than 12 countries, including the United States, Japan, Hong Kong, and Germany, highlighting the reality that international criminal syndicates are targeting Japan’s entire financial infrastructure.

Sophistication of Attack Methods and Structural Risks of Supply Chains

Accelerated Attack Speed and Zero-Day Threats via Generative AI Abuse

A major factor behind the rapid escalation of cyberattacks is the sophistication and acceleration of attack methods through the abuse of generative AI. The advent of frontier AI models such as ChatGPT and Claude Mythos has made it possible even for attackers lacking specialized knowledge to automatically discover system vulnerabilities and generate advanced attack code. Reports from organizations such as the UK AI Safety Institute (AISI) also point out that the dramatically improved bug-discovery speed by AI has caused a surge in the risk of zero-day attacks that exploit the window between vulnerability discovery and patch application. “Project YATA-Shield,” issued by the government in May 2026, and prior requests by the Financial Services Agency and the Bank of Japan have also required organizations to incorporate criteria for identifying priority-response systems, rationally streamlining testing processes, and proactively shutting down systems when necessary into their business continuity plans (BCPs) in order to counter AI-driven ultra-high-speed warfare. Defenders are being forced to transition from traditional perimeter defense to a speed-focused posture that assumes intrusion.

Third-Party Risk and the Management Blind Spot of Excessive Data Retention

A structural blind spot in the recent series of unauthorized access incidents has been intrusions via vendors and the supply chain. As seen in the cases of Daiwa Securities and Sompo Japan, attackers do not target the heavily secured core systems of financial institution headquarters, but instead attempt to infiltrate by using third-party servers responsible for inquiry management, BPO operations, cloud services, and the like as a stepping stone. As indicated by the guidelines of the Basel Committee on Banking Supervision and the Financial Services Agency, even if operations are outsourced, ultimate accountability associated with system outages or customer data leaks cannot be transferred to the vendor. Furthermore, data over-retention—where defenders continue to store personal information of canceled users and data from decades ago within their systems—has also been a factor in expanding the scale of damage. Thorough implementation of data minimization to delete unnecessary data without delay, as well as the establishment of management ledgers covering vendors and sub-contractors (fourth parties), has become an urgent task. The conceptual diagram below illustrates the structure of vendor risk.

Stricter Identity Verification and Future Risk Management Strategies

Accelerated transition to My Number Card IC chip reading

One of the measures particularly emphasized by the Financial Services Agency (FSA) in this alert is a drastic tightening of identity verification procedures in non-face-to-face transactions. There are growing concerns about unauthorized account openings through malicious “spoofing/holding-up” using forged documents and deepfake technology, exploiting leaked image data of driver’s licenses and other documents. In response, along with the amendment of the Ordinance for Enforcement of the Act on Prevention of Transfer of Criminal Proceeds, the FSA strongly urged financial institutions to implement an early transition—without waiting for the scheduled enforcement date—to completely standardize on the IC chip information reading method and abolish the image transmission method for identity verification documents in non-face-to-face transactions, which is scheduled for April 1, 2027. The method of directly reading IC chip information from My Number cards and other documents is extremely effective in physically preventing fraudulent registration through image forgery, and is positioned as the most crucial defense measure to break the vicious cycle where personal information leaked from one business operator leads to fraudulent use at another.

Enhancing Operational Resilience through Zero Trust Principles and Executive Leadership

What is required of the financial industry moving forward is not merely the submission of formal check sheets, but the establishment of substantive, management-led cyber resilience. The “Guidelines for Cybersecurity in the Financial Sector,” established by the Financial Services Agency (FSA), position cybersecurity as a top-priority issue led by management, and stipulate the appropriate allocation of authority and budget to the CISO (Chief Information Security Officer) as well as the thorough implementation of a risk-based approach. Specifically, basic requirements include multi-layered defense assuming breaches within the internal network, access control based on zero-trust principles, the introduction of multi-factor authentication (MFA) and passkeys, and the securing of immutable backups. Furthermore, deepening mutual aid systems across the entire industry beyond individual companies—through threat intelligence sharing with industry organizations such as the Financial ISAC and government agencies, as well as the regular implementation of Threat-Led Penetration Testing (TLPT) simulating actual attacks—is essential for establishing digital trust.

Reference page

• [Financial Services Agency] Strengthening Cybersecurity Measures in Light of the Current Situation and Responses Regarding Various Transaction Applications, etc.: https://www.fsa.go.jp/news/r8/sonota/20261009/20261009.html

【#FinancialServicesAgency #Cybersecurity #UnauthorizedAccess #DataBreach #RiskManagement #ThirdPartyRisk】