Corporate Cybersecurity Consultations: Q2 2026

The Security Center of the Information-technology Promotion Agency, Japan, an incorporated administrative agency, published statistics from its cybersecurity consultation desk for corporate organizations.

The covered period was from April 1, 2026, through June 30, 2026, with 302 consultations handled, an increase of approximately 6.7% from the previous quarter.

The breakdown was 65 incident-response cases, 21 cases involving routine measures, 68 support scams, and 148 other cases; the other cases included 16 scam emails impersonating company presidents and others.

The 65 incident-response cases involved 36 other cases, 11 unauthorized-access cases, 6 ransomware infections, 5 malware infections, 4 spoofed-email transmissions, 3 business email compromise cases, and 1 website defacement case.

At companies, harm may expand when employees judge communications impersonating public agencies or business partners to be legitimate and are induced to complete authentication procedures themselves. When they are directed to environments such as telephone calls or chats where consulting third parties is difficult, organizational checks are less likely to function.

If actions taken during remote operation cannot be identified, change passwords, check for unauthorized use of services, and consult the card company or bank. If personal information was stored, consultation with the Personal Information Protection Commission and other measures may be necessary because a reporting obligation may arise.

Because employees' decisions and business processes are targets in many cases, companies need to strengthen operational measures, including separation of authority, cross-checks, and checking systems, in addition to technical measures.

Since April 2025, the consultation desk has been separate from the information security consultation desk for individuals and has handled consultations for corporate organizations. In the case presented, an employee received an automated voice call claiming to be from the National Tax Agency, pressed a number provided as part of an e-Tax update, and gave an email address.

The received email had a sender display suggesting e-Tax, natural Japanese, a URL with a jp domain, and a signature claiming to be from the National Tax Agency. At the link, an automatic file download began from a site made to look like e-Tax. After the employee installed the file, another staff member noticed something suspicious, turned off the device, and ended the call.

If it is unclear which software was executed, initializing the device is recommended. However, when conducting a forensic investigation, do not initialize it; preserve it while powered off and follow the security vendor's instructions. Delete the relevant email.

As a response, change the passwords used on the device and the authentication information for internet services saved for automatic entry, and check for unauthorized use of the services. If a credit card or online banking was used, promptly consult the card company or bank.

As preventive measures, inform the entire organization about the case and provide awareness training, including how to respond to suspicious telephone calls and emails. Establish internal rules and business processes that prevent matters from being handled based on individual judgment alone, while keeping up to date with the latest incident information.

Scams targeting companies provoke urgency or anxiety through email, websites, telephone calls, and chats, while impersonating real organizations or members of management. In recent years, schemes combining remote-operation software with telephone calls and inducing victims to complete procedures themselves, including two-factor authentication, have increased. Hokuriku Bank also confirmed a suspected case in which a perpetrator impersonated e-Tax and induced a corporate internet-banking user to register a transfer destination.