Japan Institute for Promotion of Digital Economy and Community: Over 200 Japanese firms paid ransomware attackers, 60% fail to recover data

Japanese Firms Face Costly Ransomware Fallout Despite Payments

A recent survey by the Japan Institute for Promotion of Digital Economy and Community reveals that ransomware attacks have inflicted significant financial and operational damage on Japanese businesses, with mixed results for those who paid the ransom.

Out of 1,107 companies surveyed in January, 507 reported falling victim to ransomware attacks. Among them, 222 paid the demanded ransom yet nearly 60% (139 firms) still failed to recover their data. Only 83 companies regained access after payment, while 141 restored their systems without paying.

The financial impact varied widely: half of affected firms reported losses between ¥1 million ($6,300) and ¥50 million, while 4.3% suffered damages exceeding ¥1 billion. Recovery times also differed, with most companies (176) restoring systems within a week to a month, though some faced delays of three months or longer.

Experts warn that paying ransoms funds criminal activity and offers no guarantee of data recovery a reality underscored by the survey’s findings. The report highlights the need for proactive measures, including updated security software and regular data backups, to mitigate risks.

Source: https://english.kyodonews.net/articles/-/74485

Japan Research Institute, Ltd. cybersecurity rating report: https://www.rankiteo.com/company/japan-research-institute-ltd.

"id": "JAP1776666449",
"linkid": "japan-research-institute-ltd.",
"type": "Ransomware",
"date": "1/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'location': 'Japan', 'type': 'businesses'}],
 'data_breach': {'data_encryption': 'data encrypted by ransomware'},
 'description': 'A recent survey by the Japan Institute for Promotion of '
                'Digital Economy and Community reveals that ransomware attacks '
                'have inflicted significant financial and operational damage '
                'on Japanese businesses, with mixed results for those who paid '
                'the ransom.',
 'impact': {'data_compromised': 'data recovery failed for 60% of firms despite '
                                'ransom payment',
            'downtime': ['1 week - 1 month (most firms)',
                         '3 months or longer (some firms)'],
            'financial_loss': ['¥1 million - ¥50 million (50% of firms)',
                               '¥1 billion+ (4.3% of firms)'],
            'operational_impact': 'significant operational disruption due to '
                                  'ransomware attacks'},
 'lessons_learned': 'Paying ransoms funds criminal activity and offers no '
                    'guarantee of data recovery. Proactive measures, including '
                    'updated security software and regular data backups, are '
                    'essential to mitigate risks.',
 'motivation': 'financial gain',
 'ransomware': {'data_encryption': 'data encrypted by ransomware',
                'ransom_paid': '222 firms paid the ransom'},
 'recommendations': ['update security software', 'regular data backups'],
 'references': [{'source': 'Japan Institute for Promotion of Digital Economy '
                           'and Community'}],
 'response': {'recovery_measures': ['data backups (for firms that restored '
                                    'systems without paying)',
                                    'ransom payment (for some firms)']},
 'title': 'Japanese Firms Face Costly Ransomware Fallout Despite Payments',
 'type': 'ransomware'}