- The help desks opened or expanded in Japan in October and November 2026
- Which body to contact for what: IPA, the police, the Personal Information Protection Commission
- What to do first, and what not to do
- What to prepare now, while nothing is wrong
Short answer
If you think your systems may have been accessed without authorisation, do not handle it alone: ask for help early. On October 16, 2026, IPA, Japan's information-technology promotion agency, opened a "Special Help Desk for Unauthorised Access" for companies and organisations. At a ministerial meeting on October 26, the government also ordered stronger consultation services at IPA and the police, so that support is available wherever you turn. Remember: IPA for technical first response, the police for crime, and a report to the Personal Information Protection Commission if personal data may have leaked.
Who to contact for what
Technical first response: IPA
The special help desk is for companies and organisations that have been, or may have been, hit. It offers advice after hearing what is happening, suggestions for emergency measures, a list of specialist incident response firms, and pointers to other places to consult or report to. It takes calls on weekdays from 9:30 to 17:30 (except 12:00 to 13:00) and email. Other incidents and everyday prevention are handled by a separate cyber security help desk for companies and organisations.
Crime: the police
According to the National Police Agency, online consultations are sent through the e-Gov service, choosing your prefectural police. Formal damage reports go to your nearest police station. Ransomware and website defacement are among the listed examples.
Personal data leaks: report to the Personal Information Protection Commission
This is a legal reporting duty, not a consultation. A leak that may have been caused for a wrongful purpose, such as unauthorised access, must be reported regardless of how many people are affected. A preliminary report must be made promptly once you become aware of the leak (the commission’s guidelines treat roughly 3 to 5 days as a guide), and a final report within 30 days of becoming aware (60 days where a wrongful purpose is suspected). Do not wait until the investigation is finished; send a preliminary report with what you know. This article is general information, not legal advice for your situation; check the Personal Information Protection Commission’s guidance or a professional on whether a report is required.
Deadlines run from the day you become aware of the leak. Write down, on the spot, when you noticed and who checked what.
If customers or staff ask whether their own information is safe, you can point them to IPA's help desk for individuals. Since November 2, it has expanded its handling of people worried about leaked personal information.
What to do first
In its October 9 alert, IPA strongly recommends treating unusual logs or accounts as a security incident straight away, and asking a specialist firm to investigate in detail.
- Record when you noticed, who saw what, and why it looked wrong.
- Name one person in charge and route all contact through them.
- Contact your maintenance contractor or system provider, and consult IPA's special help desk too.
- Check whether personal data is involved and start preparing the preliminary report. Consult the police if needed.
Wiping computers, rebuilding servers or deleting logs in a hurry means you can never find out what happened or how much leaked. JPCERT/CC also asks that, where compromise is suspected, you preserve evidence, investigate the scope, and isolate the system.
What to prepare now
Checklist
- Do you have IPA, the police, the Commission and your maintenance contractor's emergency contacts on one sheet?
- Does your maintenance contract cover investigation and first response if unauthorised access is suspected?
- Are accounts of people who have left, or customer data you no longer need, still around?
IPA also asks organisations to review what logs they keep and for how long, to take stock of accounts, and, on the principle of not keeping what you do not need, to hold as little information as possible. Take help desk phone numbers from each body's official website, not from emails you receive.
One thing to check today
Check the phone number of IPA's special help desk on its official website and add it to your company's emergency contact list.