A chain of cyberattacks is spreading, with the ransomware damage at IDC Frontier affecting other entities. Amid concerns over the leakage of JR East member information and the government's review of remote identity verification and related regulations, attention is increasing on security-related companies ranging from large caps to small caps.
On 7 October, the cloud service of SoftBank subsidiary IDC Frontier was hit by a ransomware attack, causing disruption to spread to 495 companies and local governments. JR East announced that member information relating to as many as 6.09 million accounts may have been leaked. The National Police Agency said that reported ransomware damage in the first half of 2026 was at a record high, with VPN equipment accounting for approximately half of the entry points.
Leaks of identity verification documents, including driver's license images, occurred at Times Mobility and Park24, prompting concerns about impersonation risks. On 1 April 2027, enforcement regulations under the Act on Prevention of Transfer of Criminal Proceeds will be amended, and remote identity verification is expected to be abolished in principle. The Financial Services Agency has asked financial institutions to move to IC chip reading without waiting for the amendments to take effect.
As part of moves by the government and the Ministry of Economy, Trade and Industry, access and neutralization measures under active cyber defense began on 1 October. A “security measures assessment framework” for supply chains is also scheduled to begin operating in the second half of fiscal 2026, potentially extending stronger security measures from major companies to their mid-sized and smaller business partners.
In terms of the stock market response, Broadband Security rose 96% and Cyber Security Cloud rose 87% in the week through 9 October. The article examines the defensive capabilities of products from 20 companies, ranging from large caps to small caps, from three perspectives: protection, detection and verification.