Two recent measures show worsening ransomware pressure on Japanese businesses, with Proofpoint finding that about 40% of ransom-paying organizations remained unable to restore data or use affected systems after one payment.
Ransomware can make files inaccessible through encryption or steal information, threatening business continuity and the privacy of people whose data companies hold.
Macnica, a Yokohama-based cybersecurity company, counted 239 cases involving Japanese companies from January through October 2026. The tally was already above its 2025 full-year total of 228 and more than double the figure for 2021. Macnica’s count can include cases in which attackers left files unencrypted.
Proofpoint, a California-based security firm, surveyed 100 Japanese companies and found a 73% ransomware infection rate for 2025, compared with 38% in its 2023 survey. That increase outpaced the change in each of the other 10 countries in Proofpoint’s comparison.
The figures measure different things: Macnica counted incidents, while Proofpoint reported the share of surveyed companies infected.
Proofpoint found that 37% of Japanese firms targeted by ransomware paid in 2025, 5 percentage points above the share in 2023 but 17 percentage points below the global average. Among those who paid, about 40% could not get their data back or regain system access after paying once. Many faced further demands, the report said. Experts warned that payment does not ensure an attack will stop.
Yutaka Sejiyama of Macnica’s Security Research Center said wider use of AI by attackers may increase case numbers. He also said future incidents could expose more sensitive personal information.
Kyodo News reported that GMO Internet Group was targeted in a recent cyberattack. The attacker demanded a ransom and threatened to make personal information public.
