Over the past few weeks, companies and organizations in Japan have announced one data leak after another caused by unauthorized access. Some of you may have been asked by a business partner, “Is your website safe?” Yet many websites go untouched for years after launch. This article summarizes points that companies without dedicated IT staff can check, based on materials from the Japanese government and public institutions.
1. What is happening now
The government and IPA call for checks and reviews
On October 9, 2026, the National Cybersecurity Office of the Cabinet Secretariat published a document on responding to recent data leaks caused by unauthorized access. Noting multiple cases in which large volumes of personal data were stolen through exploited weaknesses in web systems, intrusions via contractors, and poor data management, it calls on businesses — especially those handling large amounts of personal or sensitive information — to thoroughly implement countermeasures. The measures fall into three areas:
- Proper management of web systems: apply updates promptly, stop using products whose support has ended, introduce multi-factor authentication, and disable accounts of former employees and unused accounts
- Countering intrusions via the supply chain (contractors, etc.): manage security together with contractors, check their security status, and make security requirements clear in contracts
- Proper data management: keep only the minimum information needed, delete what is no longer needed, and collect and review access logs
The document concludes that damage from cyberattacks “is no longer just a problem for the IT department,” and asks executives to treat it as a management issue.
On the same day, the Information-technology Promotion Agency (IPA) also published a list of measures to take promptly, urging organizations to identify the systems they expose to the internet and check their logs, list the external services they use, and re-examine the data they hold.
SMEs are at the center of the damage
According to the National Police Agency's report on cyberspace threats in 2025 (published March 2026), 226 ransomware cases were reported in 2025, and, as in the previous year, SMEs accounted for about 60% by organization size. In a survey of affected organizations, more than half spent a total of 10 million yen or more on recovery, and only slightly more than half recovered within a month.
The same survey found that VPN devices accounted for more than 60% of ransomware intrusion routes. It is important to check that updates have not stopped — not only for your website but also for the equipment that connects outside users to your internal network.
In IPA's “10 Major Security Threats 2026” (for organizations), ransomware ranked first, attacks targeting the supply chain and contractors ranked second, and attacks exploiting system vulnerabilities ranked fourth. Protecting not only your own company but also your business partners and contractors is now expected. When SMEs strengthen their security, they also help protect their partners.
2. 10 things to check on your website
Here are the points to check on your own website. If a web agency or maintenance company manages it for you, you can simply show them this list and ask for their answers.
| No. | What to check | Points to look at |
|---|---|---|
| 1 | Is communication encrypted (HTTPS)? | Does the address start with “https://” without browser warnings? Has the SSL certificate expired, and is it set to renew automatically? |
| 2 | Are the CMS and plugins up to date? | When were the CMS (such as WordPress), plugins and themes last updated? Are unused plugins or features still installed? |
| 3 | Are you using products whose support has ended? | Has support ended for the server OS or runtime environments such as PHP? |
| 4 | Is the admin login protected? | Are passwords easy to guess? Is there a lockout after repeated failures, and multi-factor authentication such as two-step verification? |
| 5 | Are unused accounts still active? | Do accounts of former employees or previous web agencies remain? Is administrator access limited to those who need it? |
| 6 | Is information that should be hidden visible from outside? | Are login names, software versions, configuration files, backup files or working notes placed where outsiders can see them? |
| 7 | Where is contact form data stored? | Where and how much personal information from the form is stored? Is information no longer needed deleted? |
| 8 | Are backups taken, and can you restore from them? | Can you actually restore from them? Are they stored separately from the site? |
| 9 | Are roles clearly divided with contractors? | Who is responsible for the server, the domain and site updates? |
| 10 | Do you know whom to contact if something happens? | If the site is defaced or goes down, who is contacted and who decides? |
Regarding items 2 and 3, the government's alert also calls for stopping or removing unused systems and features, and for not using products or versions whose support has ended. Items 4 and 5 appear in the same document as introducing multi-factor authentication and disabling unnecessary accounts, and item 10 as preparing an incident response system.
Item 9 is the one most often overlooked. When the server is handled by a former staff member, the domain by another company and site updates by a web agency, the most dangerous situation is that “no one was updating it.” Start by writing down who is responsible for what.
3. You don't have to do everything yourself
Of the 10 items, 1, 5, 9 and 10 can be checked in-house. Items 2 to 4 and 6 to 8 involve server and CMS settings and may require specialist knowledge.
IPA publishes guidelines on information security for SMEs (version 4.0) and offers a free self-assessment in which you answer 25 questions to check your situation. A practical approach is to get the overall picture from such public materials first and consult specialists on the parts you cannot handle.
4. LEONIA's free security check
LEONIA offers a free check of your website's security from the outside. Based on publicly available information, we check the following points and report the results:
- HTTPS (encryption) and certificate status
- Whether login names or version information are exposed
- Whether the admin login is protected
- Preparedness against unauthorized logins
- Whether files or settings that should be hidden are visible from outside
- Known weaknesses and missing settings
If measures are needed after the check, we explain them and provide a quote. We can also take care of ongoing maintenance such as regular checks and updates.
LEONIA builds websites. We see continuing to protect a site after launch as part of the same job. If you are wondering whether your site is safe, please contact us through our contact form and mention “security check.”
This article provides general information based on materials published by public institutions (as of October 14, 2026). Please consult a specialist for measures suited to your situation.
Sources (in Japanese): National Cybersecurity Office, Cabinet Secretariat (October 9, 2026) / IPA alert (October 9, 2026) / National Police Agency, cyberspace threats in 2025 (March 2026) / IPA, 10 Major Security Threats 2026 / IPA, Information Security Guidelines for SMEs, version 4.0
Frequently asked questions
- Are small companies' websites targeted too?
- They can be. According to Japan's National Police Agency, about 60% of the ransomware cases reported in 2025 involved small and medium-sized enterprises. Regardless of company size, it is important to check updates and login protection.
- If a web agency manages our site, are we safe?
- It depends on your contract. Check who is responsible for the server, the domain and site updates. The government's alert also calls for managing security together with contractors.
- What does LEONIA's free check include?
- Based on publicly available information, we check the status of HTTPS and certificates, login protection, and whether information that should be hidden is visible from outside, and report the results. If measures are needed, we explain them and provide a quote.