Digital minister's 'protect it yourself' remark and the 160M leak figure
As personal data leaks from unauthorized access to companies keep coming, Digital Minister Toshiharu Furukawa urged people at a press conference to "protect your own information yourself," drawing criticism that he was "shifting responsibility." We checked his actual words and their context in the press conference summary published by the Digital Agency, and sorted out the basis for claims such as "160 million people's data leaked" and "the culprits are running free." We set out the views of those who see his call as reasonable and those who say it blurs the responsibility of the state and companies.
Verdict: are the viral claims true?
- Misleading“Minister ordered people to protect their own data”In the Digital Agency's summary of the press conference, the wording is, “With this awareness of ‘protecting your own information yourself,’ we ask for your understanding and cooperation with efforts to prevent harm.” It was his closing line after listing three measures — stop reusing passwords, use multi-factor authentication, and be careful with suspicious emails and text messages. The imperative form, “protect your own information yourself!”, is the wording of a Jiji Press headline.
- False“He said fend for yourself, the state isn't responsible”At the press conference he said, “Cyberattacks are not a problem only for companies and organizations,” and in the Q&A he called for “basic safety measures by companies, and by individuals,” answering that the state would also work with the relevant ministries and the affected companies. He made no statement that the state bears no responsibility. At a press conference three days later, he announced that a warning aimed at businesses would also be issued.
- Misleading“Personal data of 160 million people has leaked”According to a tally by the security company Macnica, personal data that “may have” leaked in 2026 covers a cumulative (with duplicates) total of just over 165 million people. The same person is counted more than once across multiple services, so it does not mean the data of 160 million separate people leaked. JNN's tally of “160 million records” is also a cumulative count of cases announced over four weeks.
- Misleading“Not a single culprit has been caught”In the series of mass leaks since late September, no arrests of suspects had been reported as of October 26, and the commissioner general of the National Police Agency said “the background and any connections between the cases are not clear” and that investigations would continue. In other cyberattacks, however, young people were arrested over an attack on Kaikatsu CLUB, and core members of the ransomware group “Qilin” were detained in Japan and arrested in Germany.
Translated and adapted from our Japanese original. Facts are as of the original publication date unless noted.
Is Digital Minister Furukawa's “protect your own information yourself” shifting responsibility?
- Measures the minister asked the public to take
- 3
- Personal data that may have leaked in 2026 (Macnica)
- Over 165 million people (cumulative)
- Leak cases announced January–September (MM Research Institute)
- 454
The call was reasonable
Individuals' own measures can prevent some of the secondary harm after data leaks. The call was reasonable.
Shifting responsibility
Companies and the government leaked the data. The responsibility of the state and companies should come first; aiming it at individuals is wrong.
- Both sides agree
- Measures such as not reusing passwords help keep leaked data from being misused.
- What to watch next
- How far the “emergency countermeasures package” the government will put together next week goes on obligations for companies and stronger investigations.
Key points
- At his press conference on October 6, in response to a string of personal data leaks caused by unauthorized access to companies, Digital Minister Toshiharu Furukawa urged the public to take three measures, such as not reusing passwords, and closed by saying, “with this awareness of ‘protecting your own information yourself.’”
- After Jiji Press reported it under the headline “Protect your own information yourself!”, criticism such as “he is shifting responsibility” spread on social media. On the other hand, some articles pointed out that, looking at the whole press conference, he also touched on companies' measures and the state's efforts.
- The “160 million people's data leaked” figure comes from a private-sector tally that counts data that “may have” leaked on a cumulative basis, including duplicates.
- No arrests of suspects have been reported in the series of mass leaks, but police are investigating. The government began operating active cyber defense on October 1, and on October 26 held its first meeting of relevant cabinet ministers, where Prime Minister Takaichi ordered an “emergency countermeasures package” to be put together, aiming for sometime next week.
1. What is happening
Sorting out the viral claims
| Viral claim | What we confirmed |
|---|---|
| The minister said, “Protect your own information yourself!” | The press conference summary reads, “with this awareness of ‘protecting your own information yourself.’” It was his closing line after listing three measures. |
| He said the state won’t take responsibility | He made no such statement. He asked companies and individuals to take measures, and said the state would also work with the relevant ministries and affected companies. |
| Data on 160 million people leaked | It is a private-sector tally that counts data that “may have” leaked on a cumulative basis. It includes duplicates. |
| Not a single culprit has been caught | No arrests have been reported in the series of mass leaks. There have been arrests in other cyberattacks. |
What the minister said at the press conference (October 6)
Here is the flow, based on the press conference summary published by the Digital Agency.
- Cases are occurring in which IDs and passwords, credit card information, driver’s licenses and other data leak due to unauthorized access to companies and government bodies.
- There is a risk of secondary harm such as identity theft, unauthorized money transfers and fraud. Cyberattacks are “not a problem only for companies and organizations.”
- He asked the public to take three measures: stop reusing passwords / use multi-factor authentication / be careful with suspicious emails and text messages.
- “With this awareness of ‘protecting your own information yourself,’ we ask for your understanding and cooperation with efforts to prevent harm.”
In the Q&A, asked how he would deal with companies, he called for thorough “basic safety measures by companies, and by individuals,” and answered that the state would also work with the relevant ministries and affected companies, centered on the NCO (National Cybersecurity Office).
At his October 9 press conference, Furukawa, as minister in charge of cybersecurity and of the Personal Information Protection Commission, announced that a warning would be issued calling on businesses to strengthen measures, including vulnerability fixes, multi-factor authentication and measures covering their contractors.
What is the “160 million” figure?
| Figure | Source | What it counts |
|---|---|---|
| Over 165 million people (cumulative) | Tally by security company Macnica (NHK, October 16) | Personal data that “may have” leaked in 2026 |
| Over 160 million records (cumulative) | JNN tally (October 21) | Leaked records announced in the four weeks up to October 21 |
| 454 cases | MM Research Institute tally | Cases of data leaks from cyberattacks announced January–September |
All of these are cumulative figures in which the same person can be counted across multiple services. Figures at the “may have” stage can also shrink as investigations proceed. For example, Nifty initially said “up to 540,000 records,” but in a follow-up narrowed it to “up to 18,000 records.”
Major leak announcements (September–October)
- Times Car: driver’s license and other images were initially feared to number about 1.6 million; it later announced traces of external transmission for about 1.46 million
- Yamato Transport: over 5.3 million records, including users of its “Kuroneko deferred payment service”
- Furusato Choice: about 4.45 million records
- Capcom: 11.77 million records from its member service
- 22 prefectural police forces nationwide: data on police officers and others
- GMO Internet: customer data was taken from a service for FX trading, with complaints of transactions customers did not recognize
- Digital Agency: 246,000 people, including government employees, from a system shared across ministries (announced in September)
Investigations and government measures
- On October 16, National Police Agency Commissioner General Yoshinobu Kusunoki said of the series of leaks that “at this point, the background of the cases and any connections between them are not clear,” and said police would pursue investigations and hurry to uncover the facts
- On October 1, with the Act on Strengthening Cyber Response Capabilities taking effect, operation of “active cyber defense” began. GMO has asked the government to use this measure
- On October 20, the LDP compiled a proposal calling for a prime minister’s office-led “cyber response headquarters”
- On October 26, the government held the first meeting of cabinet ministers involved in cybersecurity. Prime Minister Takaichi said an “emergency countermeasures package” would be put together, aiming for sometime next week, and instructed ministers to speed up measures, including fiscal measures. The plan also includes expanding consultation and support for affected companies and bringing forward vulnerability checks of government systems using high-performance AI, and Furukawa, as minister in charge of cybersecurity, will coordinate efforts such as identifying the attackers (ITmedia NEWS, Japanese)
Sources (mostly in Japanese)
2. What each side says
We summarize each side's main arguments in our own words, based on the original statements and reporting.
The call was reasonable
Saying leaked data could lead to secondary harm such as identity theft, unauthorized money transfers and fraud, Furukawa asked for three things — stop reusing passwords, use multi-factor authentication, and do not carelessly open links in suspicious emails or text messages. He explained that if these basic measures are followed thoroughly, “much of the harm can be prevented.”
Freelance journalist Yuka Okada, after watching the full press conference video, pointed out that the minister listed secondary-harm measures that individuals can take, on the premise that this is a problem for companies and organizations. She suggested that a headline that reads as if people were told to “protect it yourself” even for data leaked by companies was too provocative.
Naigai Times reported that, because the minister mentioned “companies” first in the Q&A and said the state would also work with the relevant ministries and affected companies, his remark was not meant to shift the responsibility of companies and the government onto individuals. A column on the opinion site Agora also criticized the Jiji Press headline as misleading readers.
Ken Ogiso, an internet literacy expert and visiting researcher at GLOCOM, International University of Japan, told Josei Jishin, “He isn't really saying anything wrong.” He also said that pushing to improve the security of national government and local government systems is the government's job.
Shifting responsibility
According to Okada's article, after the remark was reported, criticism poured in on social media, such as “shifting responsibility onto individuals,” “if information entrusted to a company is stolen, individuals can't prevent it,” and “building systems that don't leak is the responsibility of companies and the government.” Okada herself pointed out that no concrete details came up at the press conference on how the state would act toward the companies that leaked data.
Professor Tetsutaro Uehara of Ritsumeikan University told Josei Jishin that Japanese companies tend to rely on cheap outsourcing for security, and that this is widening the damage. He said the National Cybersecurity Office (NCO) is limited to roles such as sharing information with some important companies and cannot interfere in the security of ordinary private companies, adding, “Basically, the Japanese government's position is that security measures are up to companies' own efforts.”
In September, it was announced that a system shared across ministries and run by the Digital Agency itself had been accessed without authorization, and that personal data of 246,000 people, including government employees, may have leaked. This has fed the view that it is wrong to ask individuals to protect themselves when even the state's own systems are not fully protected.
The minister's limited authority
Political columnist Masayuki Tsuji explained that it is not the Digital Agency but the National Cybersecurity Office (NCO) that handles cyber countermeasures, and that the digital minister's authority is limited to things like making recommendations to other ministries. He said the criticism of the remark reflects a problem with the government's structure, in which it is hard to see who is in command of cyber countermeasures.
Reading between the lines
This section is our editors' interpretation (speculation). It is not confirmed, but the facts it is based on are sourced.
Digital Minister Furukawa and the government
Why did he start with an “appeal to the public”?
SpeculationThe state has limited room to intervene directly in the security of private companies' systems, so as something that could be done right away, it appears he first presented measures for individuals to reduce secondary harm after leaks. In fact, at a press conference three days later he also issued a warning to businesses, so the plan may have been to roll out measures for individuals and then for businesses in turn. However, that order and the short phrase seem to have created the impression that he “asked individuals to take responsibility before the state did.”
Facts this is based on
- • On October 9, Furukawa explained that he had presented measures for the public “first, from the standpoint of preventing secondary harm,” and said a warning would be issued calling on businesses to strengthen measures such as vulnerability fixes and multi-factor authentication.Digital Agency (summary of Minister Furukawa's press conference, October 9, 2026, Japanese)(Oct 9)
- • The digital minister's authority is limited to things like recommendations, and cyber countermeasures are handled by the National Cybersecurity Office.Yahoo! News Expert, Masayuki Tsuji (The cyber minister's “limited authority” behind the remark, Japanese)(Oct 9)
Critics
Why did the backlash spread so strongly?
SpeculationLeaks were announced one after another at familiar services such as Times Car, Yamato Transport and Capcom, and users kept suffering harm they had no way to prevent. In September it had also been announced that data may have leaked from the Digital Agency's own system. With distrust of the government building up, the headline “protect it yourself!” arrived, and it appears this made the backlash bigger.
Facts this is based on
- • Unauthorized access to a Digital Agency system may have leaked the personal data of 246,000 people, including government employees.Jiji.com (Personal data of 246,000 people may have leaked; unauthorized access to system run by the Digital Agency, Japanese)(Sep 11)
- • Jiji Press reported it under the headline “Protect your own information yourself!”, after which criticism spread on social media.Jiji.com (Frequent unauthorized access; “Protect your own information yourself!” says Digital Minister Furukawa, Japanese)(Oct 6)Yahoo! News Expert, Yuka Okada (Criticism floods in over digital minister's “protect your own information yourself!” remark — is it “shifting responsibility”?, Japanese)(Oct 7)
What people are saying
We summarized Japanese posts on X (formerly Twitter) from October 6–26, 2026, found by searching terms such as “protect it yourself digital minister” and “Furukawa digital clipped,” along with social media posts cited in news reports (Yuka Okada's article, Shukan Josei PRIME, Naigai Times, Josei Jishin). Critical posts were the majority, but posts defending the minister and seeing the Jiji Press headline as “clipped” also drew a fair amount of reaction
The call was reasonable
- “I think the Jiji Press headline was clipped, and the minister was only saying the obvious — that he wants people to cooperate “with this awareness.””
- “He listed specific things people can do themselves, so I think it's a perfectly natural thing to call for.”
- “An ordinary appeal got clipped to look like a careless, dismissive remark. I feel for the minister.”
Shifting responsibility
- “If information I entrusted to a company gets stolen, I don't think there's anything an individual can do.”
- “It's strange to tell individuals to protect their data when even companies can't. Won't the state protect us?”
- “If he's telling us to protect it ourselves, what is the Digital Agency even for?”
Posts are paraphrased, not quoted, and individual accounts are not named.
3. Where things stand
Where they agree
- Measures such as not reusing passwords and using multi-factor authentication help reduce secondary harm after leaks.
- Individuals cannot protect the data itself that leaks from company or government systems.
Where they disagree
- Whether it was appropriate for the minister to stress individuals' mindset before the responsibility of the state and companies.
- How far the state should impose obligations on private companies' security measures.
What to watch
- The content of the “emergency countermeasures package” due next week, and the fate of the prime minister's office-led “cyber response headquarters” the LDP is calling for.
- Whether police investigations identify the attackers behind the series of mass leaks.
- Whether active cyber defense will also be used against attacks on companies outside critical infrastructure.
Digital Minister Furukawa listed three concrete measures and then asked for cooperation “with this awareness of ‘protecting your own information yourself.’” The imperative form “protect it yourself!” is the headline's wording, and he made no statement that the state bears no responsibility. On the other hand, the press conference did not present concrete steps on how the state would deal with companies. The “160 million people” figure is a cumulative number that includes duplicates. No arrests have yet been reported in the series of leaks, but there have been arrests in other cyberattacks. Those who see the call as reasonable believe secondary harm after leaks can be reduced by individuals' own measures. Those who see it as shifting responsibility believe that companies and the government leaked the data, and that the state should first show its measures and its responsibility.