[IT] Vol.5 | Ransomware Hit a Record High in Japan in 2025 — And the Trend Isn't Slowing

Japan's National Police Agency has confirmed that ransomware attacks reached a new record high in 2025, with 226 confirmed domestic cases. Manufacturers, hospitals, and local governments were among the hardest hit. As attackers grow more organized and small businesses become prime targets, cybersecurity is no longer something any organization can afford to ignore.

Background

Ransomware is a type of malicious software that encrypts an organization's data — making it completely inaccessible — and then demands a payment (a "ransom") in exchange for the decryption key. It has become the dominant form of cybercrime against businesses over the past decade.
Japan's National Police Agency reported 226 confirmed ransomware incidents in 2025, a new all-time high. Tokyo topped the list by region with 68 cases. The manufacturing sector was the most frequently targeted, followed by healthcare and information technology companies.
A technique called "double extortion" has become the new standard playbook. Rather than just encrypting files, attackers now steal the data first, then threaten to publish it online if the ransom isn't paid. This two-pronged approach gives victims two problems to solve simultaneously — recovery and preventing a public data leak — and significantly increases the pressure to pay up.

Why Is This Such a Big Deal?

Three developments make the 2025 numbers especially alarming.
First, ransomware has become industrialized. Modern attacks aren't carried out by lone hackers; they're run by organized crime enterprises operating under a model called "Ransomware-as-a-Service" (RaaS). One group develops the attack tools, another specializes in breaking into targets, another handles money laundering. It's a full supply chain — for crime. This specialization makes attacks faster, cheaper, and more frequent.
Second, smaller organizations are now the main targets. Large corporations were once the primary focus because they could afford large ransoms. But attackers have shifted strategy. Smaller companies — local medical clinics, regional manufacturers, mid-sized service businesses — often have weaker defenses and are more likely to pay quickly to get back to business. For cybercriminals, volume and efficiency beats chasing big whales.
Third, Japan's payment rate remains relatively high. International surveys suggest Japanese organizations are more likely to pay ransoms than their counterparts in North America or Europe. Paying doesn't guarantee data return — and it marks you as a compliant target for future attacks — but the short-term pressure to restore operations often wins out.

What Happens Next?

Law enforcement is not standing still. International operations in 2024 and 2025 took down major ransomware groups including LockBit and BlackCat, resulting in arrests and sanctions. But for every group dismantled, new ones emerge, often rebranding or spinning off from the old organization.
On the defensive side, the three pillars of ransomware resilience remain unchanged: regular offline backups, multi-factor authentication (MFA) on all important accounts, and ongoing security training for employees. Organizations are also increasingly being advised to have an incident response plan ready before an attack happens — not scrambling to figure out what to do once everything is locked.
The Japanese government is also expected to strengthen mandatory incident reporting and minimum security standards, particularly for industries designated as critical infrastructure.

What Do You Think?

Ransomware has grown from a niche technical threat into something that can shut down a hospital, disrupt a supply chain, or paralyze a city government. At what point does it stop being an "IT problem" and become a broader societal one?
And for anyone reading this who works for a company: do you know what your organization would do if a ransomware attack hit tomorrow morning? If you're not sure, that might be worth a conversation with your IT team.

📂 Read more articles → note.com/news_translator

News Translator｜Making complex news easy to understand.
Follow for weekly bilingual news articles.