Ransomware — Record Highs in Japan, 29 Minutes Worldwide

Ransomware holds data hostage for money, and in 2026 it remains the costliest cybercrime in Japan and worldwide. The NPA confirmed 123 cases in the first half of 2026 — the highest half-year since tracking began in 2020. Of those, 31 hit large enterprises; over half took more than a month to recover; 9 caused full business shutdowns; and 60% exceeded ¥10 million in damages.

Globally, ransomware is involved in 48% of all data breaches (DBIR 2026). CrowdStrike's GTR 2026 puts the average breakout time — intrusion to lateral movement — at a record-fast 29 minutes. "React after noticing" no longer works; peacetime design and automated detection decide survival.

Techniques keep evolving: double extortion (steal then threaten to publish) is standard; backups are destroyed first; security software is disabled; legitimate admin tools are abused (LOLBins) to frustrate recovery and investigation.

In October 2026, Japan's Active Cyberdefense Law gave the government authority to neutralize attacker infrastructure. Businesses now have the IPA's special unauthorized-access consultation desk. Don't isolate yourself — early contact with specialists decides recovery speed.

Ransomware's entry points are continuous with other methods (vulnerabilities, credentials, phishing). Entry controls (patching, strong authentication, email defense) plus exit controls (backups, segmentation, drills) are ransomware defense. Run a tabletop exercise at least once a year — decide who calls whom, when.