Ransomware Readiness in Japan: Security Is Not Enough Without Recovery

Japan’s 2026 ransomware data: the numbers management should notice

According to the National Police Agency’s report on cyber threats during the first half of 2026:

These numbers require careful interpretation.

They are not averages for every Japanese company.

Different questions had different numbers of respondents.

The 123 figure represents cases reported to police, not a complete count of every ransomware event occurring in Japan.

And a “recovery period” does not necessarily equal the period during which the entire business was completely stopped.

But together, the figures demonstrate something important:

Having security controls before an attack is only one part of ransomware risk. Recoverability after the attack matters just as much.

Official reference: NPA — H1 2026 cyber threat report (PDF) · NPA — H1 2026 statistical tables (Excel)

Ransomware has changed

Ransomware is no longer simply:

Malware enters a computer → files are encrypted → attacker demands money.

The National Police Agency describes modern attacks in which attackers first penetrate an organization—often through internet-facing infrastructure or compromised credentials—and move through the environment before the final ransomware event becomes visible.

Attackers may also steal information before encryption.

They can then threaten to disclose the stolen information if payment is not made.

This is commonly described as double extortion.

The NPA has also observed cases of “no-ware ransomware”, where attackers steal data and demand payment without encrypting the victim’s files at all.

This creates two separate problems:

Availability

Can the organization continue operating?

and:

Confidentiality

What information may have been taken?

That is why simply restoring encrypted files may not end the incident.

Official reference: NPA — H1 2026 cyber threat report (PDF)

Ransomware often becomes visible near the end of the attack

IPA’s 2026 ransomware lessons-learned handbook makes an important point.

By the time widespread encryption becomes visible, the attacker’s activity may already be at an advanced stage.

Before that moment, the attacker may have:

• entered the network;
• searched systems;
• obtained additional privileges;
• accessed important information;
• attempted to weaken security controls;
• identified backups;

and prepared the final attack.

Once systems begin failing, the organization suddenly faces multiple urgent problems at the same time:

What has been compromised?

Can operations continue?

Should systems be isolated?

Which system must be restored first?

Was information stolen?

Who needs to be notified?

What do we tell employees?

What do we tell customers or suppliers?

Who is authorized to make these decisions?

Those questions are difficult to answer during a crisis if the organization has never answered them before.

That is why ransomware readiness begins before ransomware occurs.

Official reference: IPA — Ransomware lessons learned: management handbook · IPA — Management handbook, version 1.1 (PDF)

Prevention is still essential

Resilience does not mean giving up on prevention.

The National Police Agency continues to emphasize fundamental controls.

Current ransomware incidents frequently involve internet-facing infrastructure such as VPN equipment and remote-access mechanisms.

Attackers may exploit:

• unpatched vulnerabilities;
• compromised credentials;
• weak passwords;
• configuration problems;

or insufficient access controls.

In the 2026 first-half NPA data, 36 victim organizations provided information about the likely intrusion route.

Among those responses:

18 identified VPN equipment

and:

9 identified Remote Desktop.

The denominator matters.

This does not mean exactly half of every ransomware attack in Japan enters through VPN systems.

It means VPN infrastructure represented half of the 36 incidents for which this particular information was available.

The practical lesson is nevertheless clear:

Remote-access infrastructure should be treated as security-critical infrastructure.

Organizations should know:

• which systems are exposed to the internet;
• who owns them;
• whether they are still needed;
• whether security updates are current;
• which accounts can access them;
• whether stronger authentication is used;

and what happens when a vendor stops supporting the product.

Official reference: NPA — Ransomware prevention and response

Identity is part of ransomware defense

A vulnerability is not the only path into an organization.

Credentials matter too.

If an attacker obtains valid credentials, the activity may initially look like legitimate access.

That makes identity security an important part of ransomware readiness.

Questions include:

• Who has remote access?
• Who has administrator access?
• Are old accounts removed?
• Are former employees and contractors removed promptly?
• Are privileged accounts separate from ordinary daily accounts?
• Is multi-factor authentication used where appropriate?
• Are shared accounts still being used?
• Can one compromised account reach far more of the environment than necessary?

Ransomware resilience becomes much stronger when an attacker who compromises one identity cannot automatically access everything else.

Multi-factor authentication strengthens access protection but is not a guarantee against compromise.

But prevention has an uncomfortable limitation

No organization can responsibly assume:

“Our prevention controls will work 100% of the time.”

The National Police Agency explicitly notes that completely preventing continuously changing and increasingly sophisticated cyberattacks is difficult.

That does not mean security is ineffective.

It means a mature security strategy asks two questions at the same time:

How do we reduce the probability of compromise?

and:

How do we reduce the consequence if compromise occurs?

The second question is where cyber resilience begins.

Official reference: NPA — Ransomware prevention and response

Diagram 1 — From initial access to business impact

“We have backups” is not the same as “we can recover”

One of the most important findings in the NPA’s 2026 first-half data concerns backups.

Of 50 responding organizations:

44 said they had backups.

That sounds encouraging.

But a separate question asked whether restoration from backup was successful.

Among 40 valid responses:

11 said restoration succeeded.

29 said it did not.

Among the reasons reported for failed restoration, the most common was that the backup itself had been encrypted or deleted.

Operational problems with the backup process were another reported reason.

The denominators are different and should not be combined incorrectly.

But the lesson is extremely important:

A backup is not a recovery capability until the organization has demonstrated that it can restore from it.

Official reference: NPA — H1 2026 cyber threat report (PDF) · NPA — H1 2026 statistical tables (Excel)

Five questions that matter more than “Do we have a backup?”

1. Is the backup separated from the environment that may be compromised?

The NPA recommends protecting important backups so that ransomware affecting the normal network cannot easily encrypt them as well, including offline storage where appropriate.

2. Does the backup contain what the business actually needs?

A backup may exist while omitting:

• critical databases;
• configuration;
• identity information;
• application dependencies;

or recent business data.

3. Can the backup be restored?

A backup file existing somewhere is not the same as a successful restoration.

4. How long does restoration actually take?

A system may technically be recoverable but still take too long for the business.

5. In what order should systems be restored?

Restoring ten systems simultaneously may be impossible.

The business needs priorities.

Official reference: NPA — Ransomware prevention and response

Diagram 2 — Backup is only one part of recovery

Recovery should begin with the business, not the server list

Consider a company with these systems:

• email;
• identity platform;
• ERP;
• file server;
• CRM;
• manufacturing system;
• supplier portal;
• HR platform;

customer website.

Which one should be restored first?

There is no universal answer.

The right answer depends on the business.

For a manufacturer, production systems may be critical.

For a logistics company, dispatching may be critical.

For an online business, identity and customer-facing systems may come first.

For another organization, communication capability may be the immediate priority.

That means ransomware recovery needs a business-impact perspective.

Management and operational teams should identify:

• critical services;
• systems supporting those services;
• people required;
• suppliers required;
• data dependencies;
• maximum tolerable interruption;
• manual workarounds;

and restoration sequence.

Cybersecurity teams cannot make all of those decisions alone.

Official reference: NPA — H1 2026 cyber threat report (PDF)

RTO and RPO can turn “recover quickly” into a real decision

Two useful concepts are:

Recovery Time Objective — RTO

How quickly does this system or business service need to be restored?

For example:

Can the business survive without it for:

• two hours?
• one day?
• three days?
• one week?

Recovery Point Objective — RPO

How much recent data loss can the organization tolerate?

For example:

• Can the business restore yesterday’s data?
• Does it need data from one hour ago?
• Would even several minutes of lost transaction data create a serious problem?

RTO and RPO should not be selected by IT alone.

They represent business decisions.

And more aggressive recovery requirements can require substantially more investment.

Official reference: IPA — Business / IT service continuity (archive)

A normal disaster BCP may not be enough

Many companies already have business continuity plans for:

• earthquakes;
• fires;
• floods;
• power outages;

or other physical disasters.

That is valuable.

But the NPA specifically notes that ransomware can create a different situation.

During a physical disaster, backup systems may remain trustworthy.

During a cyberattack, the attacker may have deliberately targeted:

• production systems;
• backup systems;
• administrator accounts;
• network infrastructure;

and information required for recovery.

A cyber incident may also require:

• forensic investigation;
• containment;
• credential resets;
• clean-system rebuilding;
• data-leakage assessment;
• external communication;
• law-enforcement coordination;

and verification that the attacker is no longer present.

A company should therefore ask:

Does our BCP actually include a cyber scenario?

Official reference: NPA — Ransomware prevention and response

A ransomware BCP should answer business questions

Before an incident, organizations should consider questions such as:

This is an executive discussion guide, not a regulatory checklist.

Management decisions cannot be improvised during the attack

IPA’s September 2026 ransomware handbook emphasizes rapid executive decision-making and clear management involvement.

That makes sense.

A serious ransomware incident may require decisions about:

• system shutdown;
• production;
• customer service;
• manual operations;
• external disclosure;
• supplier communication;
• investigation spending;
• recovery priorities;

and business continuity.

Some of those decisions may cost significant amounts of money.

Others may affect customers or contractual obligations.

They therefore cannot always be delegated to the employee who happens to be handling the security alert.

The organization should define decision authority before the incident.

Official reference: IPA — Ransomware lessons learned: management handbook · METI / IPA — Cybersecurity Management Guidelines v3.0: practice collection

Diagram 3 — Ransomware is a technical incident that becomes a business incident

What should happen when ransomware is suspected?

Exact incident-response actions depend on the environment.

Organizations should therefore follow their established incident-response plan and involve qualified specialists.

However, the National Police Agency provides several important general principles.

Limit further spread

The NPA advises isolating affected computers from the network when ransomware infection is suspected.

It also warns against automatically powering equipment off because doing so can destroy information needed for investigation.

Technical decisions should be coordinated with appropriate incident-response specialists where possible.

Preserve information needed for investigation

Logs from:

• network equipment;
• servers;
• endpoints;
• identity systems;

and other infrastructure

can help determine:

• how the attacker entered;
• what they accessed;
• how far they moved;

and whether they may still have access.

Contact law enforcement

The NPA asks ransomware victims to report or consult with the nearest police station or cybercrime consultation service.

Police may also be able to provide relevant information or identify available decryption resources in some cases.

Activate business response

Technical containment should happen alongside:

• management escalation;
• business-continuity decisions;
• communications;
• privacy/legal assessment;
• supplier/customer coordination where necessary;

and recovery planning.

The organization needs both tracks at the same time.

Official reference: NPA — Ransomware prevention and response · NPA — Cybercrime consultation

Do not destroy evidence in the rush to restore

There is understandable pressure during ransomware:

“Get everything working immediately.”

But rebuilding too quickly without understanding the incident can create new problems.

If the original intrusion method remains open, an organization may restore systems only to be attacked again.

If logs or evidence are destroyed, it may become more difficult to understand:

• what happened;
• what was accessed;
• whether data was stolen;

or how to prevent recurrence.

Recovery should therefore balance two objectives:

restore the business

and:

understand enough of the incident to recover safely.

Official reference: IPA — Ransomware lessons learned: management handbook

Restoring a compromised environment is different from returning to a trusted environment

Imagine a server is encrypted.

The company restores yesterday’s backup.

The server turns on.

Is the incident finished?

Not necessarily.

Questions remain:

• Is the account used by the attacker still active?
• Is the exploited VPN vulnerability still open?
• Were administrator credentials stolen?
• Is malware still present elsewhere?
• Was a backdoor created?
• Were other systems compromised?
• Was sensitive information exfiltrated?

If those questions are ignored, the organization may restore the system but not restore trust.

That creates the risk of reinfection or continued unauthorized access.

Data theft changes the recovery problem

Modern ransomware increasingly includes information theft.

That means the organization may face a situation where:

systems have been restored;

but stolen information cannot be “restored.”

Once confidential data has left the organization, recovery becomes partly about:

• understanding what information may have been accessed;
• assessing business and privacy impact;
• meeting applicable legal or regulatory obligations;
• communicating appropriately;
• protecting affected parties where necessary;

and preparing for possible publication of stolen information.

IPA’s ransomware lessons-learned handbook specifically includes preparation for disclosure of stolen data as a management issue.

This is one reason ransomware readiness must include:

data knowledge.

If an organization does not know where important or personal information is stored before the incident, understanding exposure during the incident becomes much harder.

Legal and reporting obligations depend on the incident, the affected information and applicable rules; obtain advice for the specific circumstances.

Official reference: IPA — Ransomware lessons learned: management handbook

What about the ransom demand?

This is one of the most sensitive decisions in a ransomware incident.

Japan’s National Police Agency tells victims that:

payment may provide funding to criminal groups;

and:

payment does not guarantee that encrypted information will actually be restored.

There can also be legal, sanctions, contractual, insurance and other considerations depending on the circumstances.

For those reasons, an organization should not improvise this decision based only on the ransom note.

It should involve appropriate:

• management;
• law enforcement;
• legal counsel;
• incident-response specialists;

and insurance representatives where applicable.

This article does not provide legal advice and does not prescribe a universal decision for every incident.

The important readiness lesson is:

Know who participates in this decision before you are forced to make it under pressure.

Official reference: NPA — Ransomware prevention and response · NCO — Cybersecurity law Q&A handbook v2.0: ransomware (Q62)

Cyber insurance is not a substitute for ransomware readiness

Cyber insurance may help organizations manage certain financial consequences of cyber incidents depending on the policy.

But an insurance policy cannot:

• restore an untested backup;
• recreate missing logs;
• decide recovery priorities;
• tell employees how to operate manually;
• undo stolen information;

or replace an incident-response plan.

Organizations should understand before an incident:

• what the policy covers;
• notification requirements;
• approved service providers;
• deductibles;
• exclusions;

and which decisions require insurer involvement.

Insurance can be one layer of resilience.

It is not the resilience strategy itself.

Common ransomware assumptions that should be tested

The four layers of ransomware readiness

A practical ransomware program can be viewed through four layers.

An explanatory Axton editorial model, not an official NPA, IPA, METI or NCO framework.

A company that concentrates only on Layer 1 may have strong prevention but weak resilience.

Prevention and recovery should meet in the middle

A useful ransomware program should answer all of these questions:

Exposure

What internet-facing systems could provide an entry point?

Identity

Can one compromised account reach too much?

Vulnerability management

How quickly are important exposed weaknesses addressed?

Detection

Would we notice suspicious access before encryption begins?

Containment

Can affected systems/accounts be isolated?

Backups

Are backups protected from the production environment?

Restoration

Have critical systems actually been restored in a test?

Business continuity

Can important operations continue manually or through alternatives?

Authority

Who makes urgent operational decisions?

Evidence

Are logs available for investigation?

Communication

Can we communicate internally and externally during an outage?

External support

Do we already know whom to call?

No single security product answers all of them.

The value of exercises

A ransomware plan can look excellent on paper.

The test comes when people try to use it.

A tabletop exercise might begin with a scenario such as:

Then ask:

• Who is called first?
• Who has authority to isolate systems?
• Does manufacturing continue?
• How do employees receive instructions?
• Who contacts the external security provider?
• Where are emergency contact numbers stored?
• Can customers still be served?
• Which system comes back first?
• Can backups be restored?
• Who approves external statements?
• Who contacts police?

If the organization cannot answer those questions during an exercise, that is useful information.

It found the weakness before the attacker did.

Official reference: NPA — Ransomware prevention and response

Recovery testing should be realistic

A good recovery test is not:

“We checked that the backup file exists.”

A stronger test asks:

• Can we restore the application?
• Can users authenticate?
• Can the restored application connect to its database?
• Are certificates and secrets available?
• Does the network configuration work?
• Can downstream applications connect?
• Can users actually complete the critical business process?
• How long did the recovery take?
• How much data was lost?
• What failed?

Those results can then inform realistic RTO and RPO decisions.

Official reference: IPA — Ransomware lessons learned: management handbook

Suppliers belong in the ransomware plan too

An organization may be ready internally and still depend on:

• a cloud provider;
• managed IT company;
• software vendor;
• logistics provider;
• maintenance contractor;
• payment provider;

or important supplier.

Ransomware therefore creates two different supply-chain scenarios.

We are attacked

Which external organizations do we need in order to recover?

A supplier is attacked

Can our business continue if that supplier is unavailable?

That is why ransomware readiness and supply-chain cybersecurity are closely connected.

It also creates a natural link to Japan’s emerging SCS framework.

Read about Japan’s SCS evaluation system

Smaller companies need a realistic model

A 50-person company cannot copy the security structure of a global enterprise.

It may not have:

• a CISO;
• SOC;
• incident-response team;
• forensic specialists;
• privacy department;

or dedicated business-continuity office.

That does not mean it cannot prepare.

A smaller organization can still identify:

• critical systems;
• backup responsibilities;
• external IT provider contacts;
• decision authority;
• manual alternatives;
• law-enforcement contact routes;
• insurance contacts;
• communication procedures;

and specialist support that can be called when needed.

The objective is not organizational complexity.

It is clarity before the emergency.

Official reference: IPA — Ransomware resource portal

What Axton Group can support

Depending on the agreed project scope and actual technical requirements, Axton Group LTD Japan can support organizations with areas such as:

• ransomware-readiness review;
• business-impact and critical-system mapping;
• asset, access and dependency review;
• backup/recovery-readiness discussions;
• cyber-specific BCP preparation;
• incident roles and escalation design;
• tabletop exercise planning;
• supplier and external-dependency review;
• policy and governance support;
• remediation roadmaps;

and workflow design around incident and security processes.

Where an engagement requires highly specialized technical work such as:

deep digital forensics;

malware analysis;

24/7 monitoring;

specialist incident containment;

advanced penetration testing;

or specialized OT incident response,

qualified security specialists or delivery partners may be required.

Axton should not represent capabilities it does not actually maintain.

That principle is itself part of responsible cybersecurity.

Explore scoped cybersecurity and cyber-resilience support

Security workflows can help record tasks, route reviews and retain decision histories. Explore enterprise workflow coordination

Ransomware readiness is not “expecting to fail”

Some organizations resist resilience planning because it feels pessimistic.

It is not.

Businesses routinely prepare for:

• fire;
• earthquakes;
• equipment failure;
• power loss;
• supplier disruption;

and employee emergencies.

Cyber incidents deserve the same operational discipline.

The objective of ransomware readiness is not to assume an attack will succeed.

It is to make sure that:

one successful intrusion does not automatically become an existential business crisis.

The ransomware question management should ask

Not:

“Can our security team guarantee that ransomware will never happen?”

No responsible security team can make that guarantee.

Ask instead:

“How difficult have we made it for an attacker to succeed—and if they still succeed, how quickly can we contain the damage, make decisions and restore the business?”

That is the difference between:

having cybersecurity controls

and:

having cyber resilience.

In 2026, Japanese ransomware data increasingly shows why businesses need both.

Frequently Asked Questions