Japan declares a cyber emergency and tells banks to stop trusting ID photos

Japan's government is treating a run of cyberattacks on its companies as an emergency, and its financial regulator has told banks to stop trusting photos of ID documents. At a crisis meeting on October 9, Masaaki Taira said the country is in "a state of emergency in cyber space", and cybersecurity minister Toshiharu Furukawa called the situation "extremely critical". The same day the Financial Services Agency (FSA) asked banks and crypto exchanges to verify new customers by reading the chip in their ID card instead of accepting an uploaded photo of it. The trigger was a breach at car-sharing service Times Car that exposed images of identity documents, driver's licences among them, for about 1.6 million people.

More than 20 companies in a few weeks

According to the Financial Times, more than 20 major Japanese companies have disclosed attacks in recent weeks, with tens of millions of customer records possibly exposed. Among them:

• restaurant chain Yakiniku King, where data on 10.8 million members was copied from its membership system;
• JR East, the country's largest rail operator, which lost 1.67 million customer email addresses from its booking system;
• Tokyo Metro, with 59,000 email addresses;
• the Japan Atomic Energy Agency, where passports, driver's licences and medical check results of 175 people leaked through a contractor's cloud platform.

Days earlier, travel site skyticket said 14.6 million customer records may have leaked. Japan's computer emergency team JPCERT/CC says the attackers hunt for internal app interfaces found by taking mobile apps apart, reuse leaked API keys and exploit a known SQL injection flaw in the Metabase analytics tool. Who is behind the wave is unknown. Yomiuri and Trend Micro count more than 500 incidents in Japan so far this year, against 473 in all of 2025.

Why a photo of a licence is now worthless

Times Car, run by a subsidiary of parking operator Park24, detected the intrusion on September 25. Account data on up to 6.6 million users was taken, and on September 29 the company said about 1.6 million identity verification images had leaked, including driver's licences with face photos as well as student IDs and proof-of-address documents. Credit card data was not affected, the company says.

Many Japanese banks and exchanges let people open an account online by uploading a photo of an ID and a selfie. With a million and a half real licence images in criminal hands, and AI tools that, as the regulator has warned, make it easier to turn such images into impersonation material, that check proves little. The FSA's notice drops the image upload step. A customer's phone reads the IC chip in the card instead, and the name, address, date of birth and photo stored on the chip are compared with a live image of the person. The rule was due to change by law on April 1, 2027; the regulator now wants it done sooner.

What people affected can do

Many Japanese rushed to police stations and licence centres to have their licences reissued. Police say a new licence "would have only a limited effect" in preventing fraud: a new card does not take the leaked images out of circulation. What helps more:

• watch for accounts, loans or phone contracts opened in your name, and go to the police at the first sign of misuse;
• treat calls and messages from people offering to "help" after a leak as a likely scam: the government's own security guidance warns about attackers posing as helpers;
• when a service asks you to verify your identity, prefer chip reading over sending photos of documents.

The last point applies outside Japan too. Every photo of a passport or licence uploaded to a rental, travel or dating service is one more copy that can leak, and unlike a password it cannot be changed.