Teikoku Databank said 28.9 percent of large Japanese companies have experienced a data leak or a suspected breach, according to a survey released on October 19, a figure that lands as boards are already spending more on cloud contracts and remote-work tools.
What the survey measured
The credit-research firm polled companies with capital of at least 100 million yen and more than 100 employees, a slice of the economy where customer databases, payroll files, and supplier portals sit on interconnected systems. Respondents were asked whether they had confirmed a leak, faced a credible suspicion of one, or discovered unauthorized access during the past several years.
Teikoku Databank did not publish a full sector breakdown in its initial summary, but the headline rate is high enough that risk committees are treating cyber incidents as an ordinary operating cost rather than a tail risk. Several respondents cited third-party software vendors and misconfigured access rights as recurring themes, echoing warnings from Japan's police agencies about phishing-led intrusions.
Why it matters for procurement
For procurement chiefs, the survey is less about a single dramatic hack and more about repeated small failures: shared passwords on vendor accounts, dormant APIs, and laptops that never received the latest patch. Large manufacturers that export through just-in-time supply chains said a supplier breach could interrupt production even when their own data centers were clean.
Insurance brokers in Tokyo report rising demand for cyber policies with higher sub-limits for business interruption, although underwriters are tightening questionnaires about multi-factor authentication and logging. Companies that cannot show basic controls are seeing premiums rise faster than peers in finance and trading, where regulators have pushed harder on incident disclosure.
What firms are doing next
Human-resources and legal teams are also revisiting how quickly employees must report a suspicious email. Several firms said they are moving from annual awareness videos to quarterly phishing simulations, with results fed directly to division heads rather than buried in an IT ticket queue.
The government has encouraged voluntary reporting through industry groups, but listed companies still face market pressure to disclose material incidents under Financial Services Agency guidance. Teikoku Databank's figure gives directors a benchmark when they ask whether their own incident log looks unusually quiet compared with peers.
Analysts cautioned that survey definitions vary and that some firms may classify near-misses differently. Even so, the share above one in four is a signal that cybersecurity budgets are likely to stay elevated through the fiscal year, regardless of whether the Bank of Japan pauses rate hikes this month.
Retail and logistics respondents told Teikoku interviewers that point-of-sale terminals are a common entry point because franchisees share support logins across stores. Central IT teams are responding with role-based access that expires after vendor projects end, a control that was optional before the survey highlighted how often contractors retain dormant accounts.
Export-oriented manufacturers added that customs documentation platforms are another weak link when overseas brokers reuse passwords. Several firms said they are moving those workflows behind single sign-on with hardware tokens for finance staff who approve high-value shipments.
Smaller subsidiaries inside keiretsu groups reported pressure to match parent-company security spending even when their revenue base is thinner. Teikoku's researchers said conglomerates may need tiered standards so regional units are not forced into expensive tools they cannot staff.
Board members at several listed firms told Teikoku they now receive quarterly cyber dashboards alongside earnings previews, a governance shift that was rare five years ago when IT reported only annual summaries.