How to handle Information Regarding Theatrical-style Unauthorized Access

💡 This article takes 9 minutes to read

☝️ Key points of this article:

1. A major Internet company in Japan has fallen victim to a ransomware attack.

2. While several official statements have been released, unconfirmed information and fear-mongering content are also spreading.

3. It is crucial to respond firmly, even amid repeated warnings of attacks and the publication of threatening messages.

Unauthorized access to the domain service of a major Japanese Internet company was confirmed on October 20, 2026, and even now, a week later, it remains one of the top topics of discussion in the country. On social media, influencers and accounts likely belonging to users of the attacked service have posted, such as: "Someone claiming to be the attacker has launched a website detailing the extent of the damage and the negotiation process,” “I received an email from a hacker (who appears to be the same person claiming responsibility for the unauthorized access) and am afraid my personal information might be exposed,” and similar posts have kept the issue in the spotlight for several days. In this article, let’s examine this cyber incident, which has been described in the media as “theatrical,” and consider what theatrical-style unauthorized access entails and how we can respond to it. Please note that this article is a revised and translated version of a Japanese article originally published on other social media platforms.

[Contents]

Handling Information Related to Major Cyber Incidents

How to Address Theatrical-style Unauthorized Access

Handling Information Related to Major Cyber Incidents

First of all, it is important to clearly distinguish between what actually happened (facts) and what is uncertain (speculation, information from unknown sources, rumors, etc.). From a risk management perspective, the reliability of information related to this unauthorized access can be broadly categorized as follows:

1. Top Priority: Official information from companies and other entities that have been attacked, as well as information from public agencies such as the government

2. Priority: News coverage via newspapers, radio, television, and other mass media outlets

3. Supplementaly/Handle with Caution: Information posted by individuals on social media and similar platforms, as well as compilations of such posts, and information for which facts have not been sufficiently verified

4. Claims of attackers: information such as claims of responsibility or threatening messages issued by alleged attackers

Below, I will briefly explain each category, covering its content, nature, and how to handle the information from a risk management perspective.

1. Top Priority: Official information from affected companies

The companies that have been targeted by this unauthorized access are regularly publishing information regarding this incident on the news page of their official websites. This information includes their response policy, a timeline of actions taken to date, warnings about potential future developments, and contact information for inquiries. Some of the documents released so far contain even more detailed information.

In this case, the affected companies themselves are conducting response and analysis efforts using their own white-hat hacker teams. Furthermore, given that these companies operate in the internet sector and are major players in their industries, they are likely disseminating information with a strong focus on compliance and reputation management.

2. Priority: Mass media coverage

Mass media are outlets that report on social events based on interviews and other sources, after undergoing a certain degree of editing and proofreading in accordance with reporting regulations and company policies. Given that they serve a certain public interest, their reliability is generally considered to be assured to a certain extent. However, there is a possibility of reporting false information, and there may be variations among media organizations in their perspectives on the incident and how they cover it, although this may be unlikely in this specific case when reporting on incidents that call into question a political standpoint.

Even taking this into account, since the mass media reports after conducting interviews with affected companies, experts, and others, it serves the purpose of supplementing point 1 with expert perspectives and providing explanations that are easy for the public to understand. Therefore, it can be viewed as a source of information in conjunction with point 1.

3. Supplementaly/Handle with Caution: Social media, etc.

A great deal of information regarding this incident is circulating on social media, including screenshots purportedly showing a website published by someone claiming to be the attacker, as well as screenshots purportedly showing emails from someone claiming to be the attacker. Whenever a major incident occurs, information is disseminated on social media from various public and private sources. A phenomenon seen in many major incidents and accidents, not just those involving unauthorized access. Similarly, in this case, reports of damage, opinions, speculation, and rumors are being posted from various accounts.

While some of these posts may come from accounts run by individuals who were actually affected by the unauthorized access, it is important to be aware that on anonymous platforms, it is impossible to know who is posting, and there is a possibility that information circulating may be either genuine or fake. Just as fake images are posted during disasters, it is possible for someone claiming to be the attacker to create emails or website images simply because “it seems interesting” or “it can make more impressions.” For this reason, it is safest to treat information from social media and other sources, where facts have not been sufficiently verified, as supplementary information only.

4. Information from the attackers

A notable aspect of this unauthorized access incident is that someone claiming to be the attacker has published a website detailing the extent of the damage and the course of negotiations. However, caution is warranted regarding whether this was actually published by the individual or organization purported to be the attacker, whether the information provided is accurate, or whether the large figures cited are intended as a form of intimidation. This information cannot be trusted without verification.

Furthermore, as mentioned earlier, screenshots of what appear to be this website have been posted on social media. However, spreading threatening messages or so-called evidence of information allegedly obtained by the suspected attacker, whether an individual or an organization, in this manner plays right into their hands. Additionally, accessing their website could result in the collection of personal information or exposure to malicious software. Therefore, it is best not to visit, view, or share any information published by the suspected attacker, whether an individual or an organization.

How to Address Theatrical-style Unauthorized Access

Here is the question: “How should we respond to ‘theatrical’ cyberattacks?” I would like to briefly reflect on this point at the end. The actions taken by the individual or organization believed to be behind this attack bear some resemblance to a terrorist claim of responsibility; they did not merely assert, “We are the perpetrators,” but also formally demonstrated, “These are the results we have achieved.” Some media outlets have also reported on this incident as a “theatrical attack.”

The companies that were affected by unauthorized access in this incident have taken a firm stance, stating that they “will not comply with the attackers’ demands,” as there is no guarantee that the attackers will delete the information they obtained or prevent its misuse. However, the threats and repeated warnings of attacks mentioned earlier have instilled profound fear in the companies that were compromised and the users of the affected services. Furthermore, they have starkly demonstrated the threat of ransomware to companies that have not been compromised and to consumers who have not been affected.

In a sense, this shares some similarities with media coverage of terrorism. According to the Japanese law governing police operations, terrorism is defined as “violent and destructive activities based on political or other ideologies, carried out with the intent to achieve their objectives by instilling widespread fear or anxiety.” In other words:

• It involves instilling widespread fear or anxiety to publicize one’s ideology or beliefs,

• It is based on political or other ideologies, and

• It constitutes violent and destructive activities.

It is required to satisfy all three of these points. In this case, not only is there a possibility that the dissemination of political or other beliefs is not clear at least, but while the theft of personal information in cyberspace has had a significant virtual impact, it cannot be said that direct destruction of buildings or similar structures, as seen in past acts of terrorism, actually occurred. Therefore, I do not assert that this case constitutes terrorism. However, looking at the reactions on social media and elsewhere discussed thus far, the following terminology regarding terrorism might be applicable:

Terrorism is theater. (B., M., Jenkins, 1974)

Jenkins, known as the “father of terrorism studies,” famously stated in 1974 that “terrorism is theater.” Although his theory has evolved since the September 11 attacks, perpetrators likely continue to manipulate the public through acts of terrorism in an attempt to publicize their claims and capabilities. The problem is that terrorism, major incidents and accidents, and large-scale cyberattacks like this one are highly sensational and reach many people through various media. Furthermore, even the reporting and dissemination of information may end up playing into the attackers’ hands.

Finally, if we were to provide a current answer to the question, “How should we deal with ‘theartical’ cyberattacks?”, the company that has been targeted by such attacks should work in coordination with law enforcement and other relevant agencies, resolutely stand its ground without yielding to the attackers’ demands, and provide stakeholders with information and take appropriate measures to the greatest extent possible. Consumers using the affected services should, upon receiving information from the company, take steps to protect their personal information and cooperate with the investigation to the extent possible. As for those who have not been affected, they should refrain from accessing or sharing any threatening messages or personal information of the targets released by suspected attackers or organizations, even if such information is made public. Naturally, incidents of unauthorized access cause significant fear and anxiety, raising concerns in various areas. However, while acknowledging these fears, it is also essential to maintain a firm conviction not to comply with the attackers’ demands or to spread information disseminated by them.

Update at 9:00 p.m. on October 27, 2026: The hacker group believed to be responsible for the attack announced that it would release detailed personal information, presumably belonging to users of the targeted service, daily, citing “failure to negotiate” as the reason. In response, the affected company stated in its 12th report on the matter that it “will never comply with the demands of the suspected attackers.” It called on the public to refrain from the unauthorized disclosure or dissemination of information and to be wary of phishing and fraud attempts exploiting this incident. The company also requested that members of the media refrain from excessive reporting that could lead to secondary damage. Furthermore, at its regular press conference on the afternoon of the 27th, the Cabinet Office condemned the incident as a “despicable act.” It explained that it recognizes the incident poses a risk of damage to the public’s assets, including damages arising from related incidents such as fraudulent FX trading, and outlined measures such as the compilation of an emergency response package.

Update at 4:00 p.m. on October 28, 2026: In its 13th report on this incident, the company that was attacked announced that the website containing the information allegedly stolen by the attackers had been taken down (the forced removal or suspension of online content or services through requests or legal proceedings). The company urged the public to refrain from accessing, linking to, reposting, or sharing on social media any malicious websites related to this incident or their content, and to follow the recommended procedures should a similar site go live again.