Cyberattacks in Japan may cause economic losses that extend beyond declines in individual companies’ sales to affect social infrastructure, and reports indicate that a UK government estimate puts the potential impact at approximately 0.5% of GDP.
This column assesses the losses that cyberattacks on Japanese companies are causing to the Japanese economy, based on an estimate dated 13 October 2026. The decline in sales at the four major companies totaled ¥154.20 billion, and the resulting GDP loss was estimated at ¥55.68 billion. However, despite the addition of new damage reports in subsequent disclosures, the impact on sales has still been identified for only 4 companies.
During this period, new damage reports were added for companies and organisations including the Keio Electric Railway Group, 日水物流 (a Nissui subsidiary), アルカディア and メドレー. パーク24 expects to record ¥5.5 billion as an extraordinary loss, while its sales forecast remains unchanged, and the extraordinary loss is said to be limited in nature to a transfer of income or recovery costs.
The nature of the damage is increasingly shifting from an individual-company type to an infrastructure type. The attack via IDCF Cloud affected 495 companies and local governments, while 日水物流 suspended inbound and outbound shipments at all 17 sites, indicating that the impact is spreading to services of high public importance. Disruptions to such infrastructure can also spread downstream through transactions, increasing risks across the entire supply chain.
The economic impact is difficult to reflect directly in the affected companies’ financial results because losses incurred by business partners and customers are not readily captured, and simply aggregating declines in sales may therefore underestimate the total losses.
The situation is increasingly taking on the characteristics of concentrated risk similar to that posed by a natural disaster, and the overall picture may change depending on information disclosed in the future.