By Hamza Faisal
Japan's government on Friday unveiled an emergency cybersecurity package headlined by a new public-private "cyber rescue team," responding to a wave of hacking incidents that has hit dozens of businesses across the country in recent weeks.
The package was approved at a ministerial meeting chaired by Prime Minister Sanae Takaichi, eleven days after she ordered officials to draw up emergency measures following a series of high-profile data leaks. It rests on four pillars: using artificial intelligence to strengthen basic defences, improving the collection and analysis of threat information, mounting a strategic response to attacks, and supporting victims while preventing further damage.
A rescue team and a 'top gun' unit
At the centre of the plan is the rescue team itself: experts drawn from government and the private sector who will be dispatched to companies hit by cyberattacks to help with the first response, contain the damage and get systems back online. A separate advisory team will help companies judged to be at risk before they are targeted, and a secretariat will be set up within the current fiscal year to coordinate deployments when an incident is particularly serious.
Alongside it, the government will field a "top gun" team of elite cybersecurity specialists to counter hackers and run simulated attacks — with the first exercises starting this month — to test and strengthen defences. Tokyo also plans to use AI to hunt for weaknesses in computer systems and to work with overseas IT firms and advanced AI developers to keep its information about vulnerabilities up to date.
The package goes further than defence. The government intends to build the ability to neutralise threats by proactively accessing servers used by attackers, and in incidents that could seriously affect national security it will dispatch a joint support team drawn from the National Cybersecurity Office, the National Police Agency and the Defence Ministry. About 10 billion yen in reserve funds has been set aside for the measures.
The breach wave behind the package
The trigger was a spate of unauthorised-access incidents that has rattled corporate Japan. Internet group GMO Internet disclosed on October 21 that outsiders had accessed its systems, leaking user information from online services and carrying out unauthorised transactions in some customers' securities and foreign-exchange accounts. A ransom was demanded in the attack.
GMO's information-security arm said last month that a Chinese artificial-intelligence cybersecurity tool, Artex, was used in several of the recent hacks of Japanese companies. Artex is already notorious in the region: it was the open-source AI agent behind hacks on South Korean banks earlier this year, before its developer pulled the plug — and it later returned as a commercial product.
AI on both sides of the fight
The episode captures how artificial intelligence now sits on both sides of the cyber fight. Attackers are using AI tools to find previously unknown ways into corporate systems, while defenders — including Japan's government — are turning to the same technology to spot weaknesses first.
Takaichi's package is one of the most concrete government responses yet to that shift, and its test will come quickly: whether a rescue team can reach a stricken company fast enough to limit the damage, and whether the "top gun" unit can stay ahead of attackers who are themselves armed with AI. For Japanese businesses, the message from Tokyo is clear — the next breach is a matter of when, not if, and the state now intends to be in the room when it happens.
