Regional Watch · Japan & Southeast Asia · October 2026
日本語版はこちら/Japanese Version: [Japanese version link]
By 9 October, Japanese organisations had publicly disclosed 659 security incidents in 2026, already more than the 594 recorded in the whole of 2025. A senior ruling party lawmaker now calls it a state of emergency. For multi-regional enterprises in Southeast Asia, the more important story is not the number. It is where the gaps are opening: between headquarters and the subsidiaries it cannot see. That HQ-subsidiary gap in Southeast Asia is now one of the defining problems of cross-border cybersecurity.
Japan is the latest example of a problem every enterprise operating across regions shares. Japanese subsidiaries in Southeast Asia are simply where it shows first.
A month that broke the pattern
On 7 October, ransomware hit IDC Frontier’s IDCF Cloud, disrupting 495 companies and local governments that use the service. One of them, Nissui’s logistics arm Nissui Logistics, which used IDC Frontier as its outsourced data centre, could not ship or receive goods until it partially resumed two days later. Retail, rail, finance, logistics and public services all reported incidents within weeks of each other.
Trend Micro’s count of publicly disclosed incidents passed the 2025 total before the end of September. Masaaki Taira, who chairs the Liberal Democratic Party’s National Cybersecurity Strategy Headquarters, described cybersecurity as having entered “a new phase” and the situation as “an emergency, a time of crisis.”
A cross-border cybersecurity problem, not a Japan-only one
Waves like this are not unique to Japan. In 2025, Scattered Spider’s campaign against UK retail cost Marks & Spencer an estimated £300 million and the Co-op £206 million, and severely disrupted production and sales at Jaguar Land Rover. This month, Ahold Delhaize took systems offline across its US and European brands, from Albert Heijn and Delhaize to Food Lion and Stop & Shop. South Korea is investigating breaches at nine banks at the same time as Japan’s wave.
What is specific to Japan is the loss of a natural barrier. The Japanese language once slowed foreign attackers down. Nobuo Miwa of S&J Corp. told Reuters that AI has largely erased the language and other barriers that once hindered foreign hackers: “AI doesn’t get tired.” Japan’s wave is the first large-scale test of what happens when that barrier disappears. It will not be the last.
Two operating models, two kinds of subsidiary security risk
In LLG’s experience across enterprise IT and digital transformation in the region, multi-regional enterprises tend to run security in one of two ways.
Centralised · typical of US and EU groups
One control plane for every country
Visibility is strong. The failure mode is concentration: one compromised cloud tenant, identity provider or managed service provider can reach every subsidiary at once.
Federated · typical of Japanese groups
HQ sets a baseline, each country builds its own
Local teams move quickly and fit local conditions. The failure mode is invisibility: gaps open at subsidiary and country level, where HQ cannot see them.
The data on the federated side is stark. A Nomura Research Institute survey found that only 57% of Japanese companies knew the security status of their overseas subsidiaries, against about 80% of US and Australian companies. Only 35.2% applied security controls to overseas partners and subcontractors, against more than 80% in the US and Australia. That survey dates from 2020, and it remains the most recent cross-country comparison we have found.
KPMG Japan’s Cybersecurity Survey 2026, fielded in late 2025 across 424 listed Japanese companies, shows how little has changed:
24.8%
of HQs set the rules and check implementation at overseas subsidiaries (41.7% for domestic ones)
40.8%
leave overseas subsidiaries largely to themselves, or do not know their security status at all
14.5%
extend group-wide IT asset management to overseas subsidiaries (33.0% for domestic ones)
On overseas vendors and partners, the most common answer to whether an attack had come through them was “we don’t know” (36.3%). KPMG states plainly that leaving security entirely to overseas subsidiaries raises risk, and that many real incidents have started at overseas sites. In other words, subsidiary security risk is concentrated exactly where headquarters has the least visibility.
The HQ-subsidiary gap in Southeast Asia, case by case
The cases below were all disclosed by the Japanese parent companies themselves. What they share is not the attack technique. It is how, and how late, the incident reached headquarters and the public.
| Subsidiary | What happened | What it shows |
|---|---|---|
| H.I.S. Tours Thailand |
File server intrusion detected 11 December 2025; passport data of up to 627 travellers potentially exposed. Reported to Japan’s regulator that month; publicly disclosed 7 October 2026. | About ten months from detection to public disclosure, partly spent finding out what data the server held. |
| Siam Okamura International Thailand |
Suspected intrusion on 23 December 2025. DragonForce posted a claim on its leak site on 4 April 2026; Okamura disclosed on 10 April. | Public disclosure came after the attacker’s own announcement. |
| Mitachi group Hong Kong → Malaysia, Indonesia |
Ransomware at the Hong Kong company in June 2025 spread to network-connected group companies in China, Malaysia and Indonesia before connections were cut. | A federated network still connects. One weak site can carry an attack across borders. |
| Pokka (Sapporo) Singapore |
Unauthorised access confirmed 14 June 2026, alongside a Canadian group company; disclosed 24 June. | Overseas units in different regions hit in the same window. |
| Sanko Fastem (Sanko Techno) Vietnam |
Ransomware encrypted servers at the Vietnamese subsidiary; disclosed 28 August 2026. | Manufacturing subsidiaries remain a steady target. |
The timing matters because local rules do not wait for headquarters. Thailand’s PDPA, for example, expects the data controller to notify the regulator within 72 hours of becoming aware of a breach, where feasible. Across the region, as we set out in One Strategy, 11 Rulebooks, the obligations sit with the local entity under local law. In a federated model, the subsidiary may be the only part of the group that knows the clock has started.
Why US and EU groups are next
Centralised groups are not immune to the federated problem. They are heading towards it. Data localisation and sovereignty rules in Vietnam, Indonesia and elsewhere are pushing multinationals to run more systems, data and vendors in-country. Each local deployment is a small step away from one control plane and towards the federated model, often without the governance that should come with it.
The result is a hybrid: central platforms with growing local exceptions. It combines both failure modes. One central compromise can still reach everyone, while the local exceptions open the same blind spots Japanese groups are dealing with today.
What You Need to Know
- Japan’s wave is the latest, not the only, example of a cross-border cybersecurity failure. AI has removed the language barrier that once protected it.
- Federated groups fail through invisibility; centralised groups fail through concentration. Most multinationals in SEA are drifting towards a hybrid that carries both risks.
- Only about 1 in 4 Japanese listed companies verifies security at its overseas subsidiaries, and only 14.5% extend group-wide IT asset management to them.
- Incidents at Japanese subsidiaries in Southeast Asia can take months to surface, sometimes only after an attacker’s leak site, while local notification clocks run in hours or days.
What You Need to Do
- Know what every subsidiary runs. Build a group-wide inventory of internet-facing systems, cloud tenants and privileged accounts in each country. You cannot protect, or report on, what HQ cannot see.
- Verify, don’t just set policy. Move overseas subsidiaries from “policy issued” to “implementation checked”, starting with the markets that hold the most sensitive data.
- Set a group escalation clock shorter than the local one. If Thailand expects 72 hours, HQ needs to hear within 24. Write it into subsidiary procedures and test it.
- Map the connections between sites. Segment group networks so a compromise in one country cannot travel to the next, as it did from Hong Kong to Malaysia and Indonesia.
- Extend vendor assurance to local partners. Distributors, dealers, payroll firms and system integrators chosen locally are part of the group’s attack surface, whether HQ approved them or not.
- Watch from the outside in. Monitor leak sites, local-language disclosures and local regulator actions for every country you operate in, so HQ does not learn about its own subsidiary from an attacker.
The gap is the risk
Japan’s month of incidents will produce new national structures, guidance and support programmes. Those matter. But for any group running operations across Southeast Asia, the decisive cross-border cybersecurity question is simpler: when something goes wrong at a subsidiary in Bangkok, Ho Chi Minh City or Jakarta, how long before headquarters knows? Japanese subsidiaries in Southeast Asia, and the groups that own them, are answering that question in public right now. US and European groups should ask it before they have to.
This is the gap Logic Lock Group works in: country-level intelligence on threats, regulation and vendors across Southeast Asia, led by a founder who has spent more than 25 years working between Japanese headquarters and their operations across Asia Pacific.
日本語版はこちら/Japanese Version: [Japanese version link]
Sources
- Trend Micro, Security incident trends in Japan (Japanese), 16 October 2026.
- ScanNetSecurity, LDP National Cybersecurity Strategy HQ chair Masaaki Taira (Japanese), 19 October 2026.
- BleepingComputer, Ransomware attack disrupts Japan’s IDCF Cloud used by govt clients, 8 October 2026.
- Nihon Shokuryo Shimbun, Nissui Logistics system outage (Japanese), 9 October 2026.
- Insurance Journal / Reuters, South Korea, Japan buffeted by hacks as AI lowers bar for cybercriminals, 9 October 2026.
- SC World, Scattered Spider attacks cost UK retailers hundreds of millions, 2 January 2026.
- ITV News, M&S hackers claim to be behind Jaguar Land Rover cyber attack, 4 September 2025.
- Shattered, Ahold Delhaize cyberattack hits US and EU stores, October 2026.
- Nomura Research Institute, Japanese companies’ security measures for overseas subsidiaries, 15 February 2021 (survey July–September 2020).
- KPMG Japan, Cybersecurity Survey 2026 (Japanese; fieldwork 2 October–28 November 2025, 424 listed companies).
- Security Measures Lab, HIS Thai subsidiary unauthorised access (Japanese), October 2026.
- Security Measures Lab, Okamura Thai subsidiary and DragonForce claim (Japanese), April 2026.
- Security Measures Lab, Mitachi overseas group system outage (Japanese), July 2025.
- ScanNetSecurity, Unauthorised access at two Sapporo Holdings overseas companies (Japanese), 29 June 2026.
- ScanNetSecurity, Ransomware at Sanko Techno’s Vietnamese subsidiary (Japanese), 1 September 2026.
- Formichella & Sritawat, From Awareness to Accountability: Breach Notification Under Thailand’s PDPA, 4 June 2026.
