Japan has declared a “state of emergency in cyber space.” The common thread in these breaches is identity.

On 9 October, Masaaki Taira, head of Japan's National Cybersecurity Strategy Headquarters, said the country is in a cyberspace state of emergency. Rail operators, retailers, hospitals and government facilities have all been hit. More than 20 major firms have reported attacks, and tens of millions of customer records may have leaked.

By using stolen credentials and identity details, the attackers breached third-party contractors and suppliers, then used shared cloud infrastructure to move laterally into downstream organizations.

The most telling response didn't come from a security agency. It came from the Financial Services Agency, which told banks to stop accepting driving licenses as ID when opening new accounts. The reason is simple. License photos from a breached car rental app are reportedly selling on the dark web for about ¥25 each. Once a document can be copied that cheaply, it no longer proves who is holding it. The same logic applies inside your organization. A valid login no longer proves who is behind it, yet most of your controls still treat it as if it does.

What actually happened in Japan?

The coverage numbers are large. JR East said its booking system may have exposed 1.67 million customer email addresses. One car-sharing service affected 6.6 million accounts, and one convenience store chain lost 2.15 million customer records. Ransomware hit 123 cases in six months.

The pattern matters more than the totals. A ransomware incident at IDC Frontier, a SoftBank cloud subsidiary, was linked to leaks at JR East, local municipalities and hundreds of other enterprises. Experts quoted in the coverage describe attackers who industrialize one playbook across sectors. They reuse stolen credentials and identity data, enter through contractors and suppliers, and move through shared cloud infrastructure into downstream companies.

Why didn't anyone see it coming?

Because very little of it looks like an attack. The attacker is already inside, with valid credentials. A contractor account signs in at the expected time. A service account calls the systems it always calls.

Your tools each see a slice. The identity provider sees a successful login. The cloud console sees a role. The SaaS app sees a session. None of them sees the full access chain from one stolen credential to your customer data, so no one can say where it stops.

What does the FSA decision teach you?

The regulator didn't ask banks to inspect licenses more carefully. It retired a proofing method that had stopped working and moved to chip-based ID.

Your version of that decision is to stop treating access as safe just because you granted it once. Think of dormant accounts, standing admin rights, stale access keys, and contractor access that outlived the contract. That's access nobody granted, nobody owns, nobody checks. It's also exactly what stolen credentials inherit.

Where does Unosecur fit?

The attackers in Japan ran one playbook. The Unified Identity Fabric breaks it at each step.

One view of every identity: Stolen credentials work because no one sees every account they unlock. The Unified Identity Fabric brings your AI agents, non-human identities, and human identities into one connected view across cloud, SaaS, and on-prem systems. You see what each identity holds and what it can reach.

Clear sight of supplier access: Contractors were the way in. A supplier account is still an identity with permissions, so you can see which ones reach sensitive data and remove access they shouldn't have. Early signs of a borrowed identity: A reused credential leaves traces. Insights surface patterns such as SSO failures, brute-force attempts, and inactive identities, so your team investigates before access turns into ransomware.

Least privilege you can prove: Stolen credentials inherit dormant accounts, over-permissioned roles, and stale access keys. Guided remediation walks your team through removing them and verifies each fix took effect. That shrinks the blast radius of the next unexpected login.

What should you ask your team this week?

Start with four questions. 

• Which suppliers can access customer data today, and who approved that access? 
• How many dormant accounts still hold privileged access?
• If a service account is compromised tonight, what is its blast radius and how far can it reach?
• Is there a single plane of visibility across all human, non-human, and AI identities in your environment?

If those answers take weeks to assemble, you'll find out when an auditor or an attacker does. Japan decided a copied license isn't proof of identity. A stolen login isn't either. Uncover your identity blind spots before an attacker does. Book a demo

‍