Why Japanese companies need to see themselves from the outside: what the data says about ransomware, and what ZeroKai does

Key points

• Ransomware cases reported to the National Police Agency (NPA) numbered 226 in 2025, and have stayed around 200 a year since 2022.^[1][2]
• Of the 226 cases in 2025, 143 were small and medium-sized enterprises (SMEs). Size is no protection.^[1]
• In the NPA's survey of victims (92 valid answers), 66.3% said attackers came in through VPN devices and 20.7% through remote desktop. Both are doors that can be seen from the internet.^[1]
• The first step is knowing what can be seen from outside. ZeroKai reads only public records and shows that view, with evidence.

Ransomware in Japan remains high

According to the NPA, ransomware cases reported by companies and other organisations were 230 in 2022, 197 in 2023, 222 in 2024 and 226 in 2025.^[2][3][4][1] The NPA describes 2025 as remaining at a high level.^[5]

Of the 226 cases in 2025, 143 were SMEs and 64 were large companies.^[1] In the first half of 2025 alone, SMEs accounted for 77 cases, about two thirds, the highest count and share on record. The NPA links this to Ransomware-as-a-Service, which lets far more people launch attacks, reaching smaller firms whose defences tend to be thinner.^[6]

The methods are getting worse. Of the 153 cases where police could confirm the method, 136 (88.9%) were double extortion: data was stolen as well as encrypted, with a threat to publish it.^[1] By industry, manufacturing made up about 40%.^[5]

Most attacks come through doors visible from outside

Every year the NPA asks victims how the attackers got in. In 2025, of 92 valid answers, 61 (66.3%) said through a VPN device and 19 (20.7%) through remote desktop.^[1] The pattern has held since 2022.

The NPA points to very weak IDs and passwords, and to unneeded accounts left unmanaged. In one case an overseas office's equipment was not being managed, and the attackers used it to reach the head office in Japan.^[7] Not knowing what you expose to the internet is a risk in itself.

Surveys of smaller firms show the same thing. In IPA's FY2024 survey, 48.0% of companies hit by unauthorised access said a vulnerability, such as a missing patch, was exploited, and 19.8% were breached via a business partner or group company.^[8]

Global research agrees. Verizon's 2025 Data Breach Investigations Report (DBIR) found that exploiting vulnerabilities was the initial access vector in 20% of breaches, up 34% on the year before.^[9] Edge devices and VPNs were 22% of the targets of that exploitation, almost eight times the 3% seen a year earlier. Only about 54% of those vulnerabilities were fully fixed, and the median time to fix was 32 days.^[10]

The US agency CISA publishes the Known Exploited Vulnerabilities (KEV) catalog: vulnerabilities that attackers are confirmed to be using. The 8 October 2026 edition lists 1,739 entries, 361 of them marked as known to be used in ransomware campaigns. 245 were added during 2025.^[11]

Notable incidents in Japan

The damage is not limited to any one industry. Below are major cases from the past few years, based on what the companies and public bodies themselves announced.

1. July 2023

   Port of Nagoya (Nagoya United Terminal System)

   A ransomware infection stopped container gate-in and gate-out for about three days. 37 ships had their cargo-handling schedules disrupted, and an estimated 20,000 containers were affected. ^[12]

2. June 2024

   KADOKAWA Group

   Services centred on niconico went down. Personal data of 254,241 people was confirmed leaked. The root cause is believed to be an employee's account credentials stolen through phishing or a similar attack. ^[13]

3. December 2024

   Japan Airlines (JAL)

   A flood of data was sent at the router linking JAL's internal and external networks (a DDoS attack), causing a system outage. 71 domestic and international flights were delayed by 30 minutes or more and 4 were cancelled. No customer data was leaked. ^[14]

4. September 2025

   Asahi Group Holdings

   Attackers entered the data-centre network through network equipment at a group site, and ransomware encrypted multiple servers. Personal data of 1,914,000 people was or may have been exposed. Containment and recovery took about two months. ^{[15] [16]}

5. October 2025

   ASKUL

   Ransomware encrypted ASKUL's logistics systems and shipping from its distribution centres stopped entirely. The attackers are believed to have entered with stolen credentials, and backups were encrypted and deleted too. According to Tokyo Shoko Research, about 739,700 personal records may have been leaked, and the company booked an extraordinary loss of ¥5.216 billion for the outage. ^{[17] [16]}

The damage: outages, leaks, and long recoveries

In the NPA's survey of 2025 victims, more than half of organisations spent ¥10 million or more in total on investigation and recovery. Only just over half recovered within a month, and recoveries are tending to drag on.^[5]

Smaller firms are hit hard too. In IPA's survey, the average loss from a cyber incident was ¥730,000 (up to ¥100 million), and recovery took 5.8 days on average. About 70% of affected companies said their business partners were affected as well.^[8]

Data leaks are rising as well. Tokyo Shoko Research counted 180 personal-data leak or loss incidents announced by listed companies and their subsidiaries in 2025, covering 30,636,910 people, almost double the year before. The most common cause was malware or unauthorised access: 116 incidents (64.4%).^[16]

Worldwide, IBM's 2025 study put the average cost of a data breach at USD 4.44 million. In the United States it reached a record USD 10.22 million.^[18]

What experts rank as the top threats

In IPA's “10 Major Security Threats 2026” for organisations, ransomware is number one for the eleventh year running, followed by attacks on supply chains and contractors. The list also includes exploitation of system vulnerabilities (4th), attacks on remote-work environments (8th) and DDoS (9th).^[19]

Start by knowing how you look from outside

The statistics and incidents above share one thing: attackers look at a company from the internet first, searching for a way in. Exposed VPN devices, remote desktop, forgotten servers at a branch office, a mail domain with weak settings. All of these can be seen from outside.

Yet IPA found that about 70% of SMEs have no organised security function, and 62.6% made no security investment in the past three fiscal years.^[8] Companies need a way to start by learning how they look from outside, even without a dedicated security person.

What ZeroKai does

ZeroKai takes a domain name, reads what is already public about it on the internet, and organises the risks visible from outside.

• It never contacts the target. No port scans, no page loads, and DNS queries go through public resolvers.
• What it checks: email authentication (SPF and DMARC) and DNS settings, host names recorded in Certificate Transparency logs, domain registration and expiry, and network information for IP addresses. Public services (from Shodan's observations) are included only for domains you have verified.
• Details are for the owner only. Asset lists and finding details appear only when your email domain matches, or when a DNS TXT record confirms ownership.
• Every finding comes with its evidence, its source and the time it was seen, so you can show it to colleagues or business partners as is.
• Anything that could not be read is shown as “not covered”, never as “no problem”.
• Vulnerability intelligence from CISA KEV and JVN iPedia is loaded regularly and can be browsed in the console. Automatically matching CVEs to your assets is planned for later.

Why it helps

• You can start without a dedicated security person. All you need is a domain and an account.
• You see the same outside view an attacker sees, and which issues to fix first.
• Because findings carry evidence and timestamps, they help when a customer asks about your security. In IPA's survey, 42.1% of companies that had received a security request from a customer said meeting it was a major factor in winning the business.^[8]
• Because it never talks to your systems, it puts no load on production.

What you can do today

1. 01List every VPN device and remote desktop you expose to the internet, including those at overseas offices and group companies.^[7]
2. 02Remove accounts nobody uses and replace weak passwords.^[7] Turn on multi-factor authentication as well.
3. 03Keep logs as a matter of routine, and store backups offline too.^[7]
4. 04Regularly check whether vulnerabilities listed in KEV affect your equipment.^[11]
5. 05Check how your domain looks from outside. A free ZeroKai assessment is one way to start.