IPA Announces 'Top 10 Information Security Threats 2026'

Information-technology Promotion Agency (IPA) decided and published the "Top 10 Information Security Threats 2026" following deliberations and voting by a selection committee of about 250 experts, based on accidents and attacks that occurred in 2025. The ranking for organizations is shown with positions, while the list for individuals is presented in Japanese syllabary order.

At the top of the organization-oriented list, 1st is "damage from ransom attacks," 2nd is "attacks targeting supply chains and subcontractors," and 3rd is the newly selected "cyber risks related to the use of AI." Other items that continue to appear near the top include vulnerability exploitation attacks, targeted attacks, and attacks stemming from geopolitical risks.

For individuals, traditional threats such as "unauthorized logins to online services," "unauthorized use of credit card information," and "phishing" are listed, while "unauthorized use of internet banking" has reappeared on the list for the first time in four years. IPA has published related materials including explanatory documents, handbooks, presentation materials, and countermeasure mapping sheets, and has clearly stated citation conditions and usage cautions.

The announcement was made on 2026-01-29, and subsequent revisions of the explanatory documents and publication/replacement of related materials have continued. IPA requests users to follow usage rules such as citing sources and states that it accepts no responsibility for damages resulting from the use of the published materials.