Skip to content
CTI Academy Sponsor CTI Academy
JP

Ransomware attacks in Japan

301 organisations in Japan have been listed on ransomware leak sites, ranking #11 worldwide. Updated .

Victims
301
1.3% of global total
Global rank
#11
of 181 countries
Active groups
80
Most: Qilin
Sectors
18
Most: Manufacturing

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in Japan. Figures are computed from the tracked records, not inferred.

Japan sees 301 ransomware attacks reported globally ranking 11th - most active groups include Qilin, Thegentlemen, Safepay targeting Manufacturing, Technology, Agriculture and Food Production sectors.

Japan in the global picture

Japan accounts for 301 of the ransomware disclosures tracked here, ranking #11 worldwide and making up 1.3% of the global total. The sectors listed most often are Manufacturing, Technology, Agriculture and Food Production.

Who is most active in Japan

Qilin — 45 victims in Japan. Qilin ransomware was first observed in July of 2022. Thegentlemen — 25 victims in Japan. Safepay — 13 victims in Japan.

Ransomware threat profile: Japan

Japan ranks #11 worldwide for ransomware disclosures, with 301 victims in this database — 1.3% of the global total. The groups listing the most organisations here are Qilin, Thegentlemen and Safepay.

The most frequently listed industries in Japan are Manufacturing, Technology, Agriculture and Food Production. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

The volume reflects Japan's integration into the global economy and the reach of ransomware operations that target organisations of every size. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in Japan 301

Page 1 of 4
Organization Disclosed
Kissei Shoji
Everest
Saga University
Thegentlemen
Keio Corporation
Qilin
japantimes.co.jp
Eclipse
Topcon Healthcare
Everest
Camellia Line (ferry and RoRo operations)
N0n
Tsuneishi / Kambara Kisen (shipbuilding and ship management)
N0n
KOIKE Sanso Kogoyo Co. Ltd.
Exitium
enTouch
Black x
Mutsumi Group
Qilin
Mutsumi Group
Qilin
The Japan Times
Eclipse
The Japan Times
Eclipse
Nissho Electric Manufacturing Co., Ltd.
Qilin
SKLG
Qilin
SKLG
Qilin
UNIRITA
Everest
Astemo, Ltd.
Metaencryptor
Astemo, Ltd.
Metaencryptor
IKEGAMI TSUSHINKI COMPANY LIMITED
Qilin
kit-e.jp
Auditteam
Hashimoto Jimuki
Vexy ransomware
Hashimoto Jimuki
Vexy ransomware
Nippon Steel Corporation
Metaencryptor
Nippon Steel Corporation
Metaencryptor
ryomo.co.jp
Safepay
ryomo.co.jp
Safepay
Tentac
Thegentlemen
Tentac
Thegentlemen
Wada Farms
Thegentlemen
Wada Farms
Thegentlemen
ki***jp
Auditteam
ki***jp
Auditteam
Mitsuwa Trading Co., Ltd
Qilin
REXT Holdings Co., Ltd.
Ransomhouse
REXT Holdings Co., Ltd.
Ransomhouse
bkc.org
Lockbit5
Corona Corporation
Metaencryptor
Akatake Engineering
Thegentlemen
am-bition.jp
Settra
ASCII Group
Qilin
TOA
Thegentlemen
DAISEN
Ailock
Hitachi High-Tech
Coinbasecartel
Yaomasa
Ailock
East Field Corporation
Qilin
DHC
Thegentlemen
Allied Telesis
Everest
Apollo Office System
Orova
azn.co.jp
Safepay
********.com.jp
Section9
Nichirei
Ransomhouse
Nichirei
Ransomhouse
yano.tokyo
Blackout
yano.tokyo
Blackout
Kyokuto Kaihatsu Kogyo
Incransom
Kyokuto Kaihatsu Kogyo
Incransom
Dink Co Ltd
Thegentlemen
Kaneko
Thegentlemen
Nihon Kotsu Co., Ltd.
Ailock
PanasonicAero
Coinbasecartel
Solid Advance Inc.
Ailock
DHC Corporation
Thegentlemen
Musashino University
Qilin
higuchi-inc.co.jp
Stormous
daikyonishikawa.co.jp
Lockbit5
TINYpulse NINTENDO BREACH (nintendo.com)
Shadowbyt3$
musenet.co.jp
Safepay
tokyocivil.co.jp
Safepay
Nintendo Company (Nintendo.com)
Shadowbyt3$
New FACOM Co., Ltd.
Cmdorganization
Tokabei Japan
Thegentlemen
Danzo Group
Thegentlemen
AKM
Everest
GS Yuasa Lithium Power
Akira
cyuou.com
Safepay
eitecpro.co.jp
Safepay
Koa Glass
Thegentlemen
Kabushiki Gaisha Hodozuka Setsubi
Payload
soft-inc.com
M3rx
Oriental Diamond
Thegentlemen
Zojirushi
Akira
East
Thegentlemen
Marutake
Thegentlemen
Nostrum
Thegentlemen
hokuyo2006.co.jp
Safepay
JOT
Fulcrumsec
kisnet.co.jp
Braincipher
Medical PAY
Killsec
orekait.com
Lockbit5
TokyoHosoKogyo Corporation
Qilin
Denso
Qilin
GoTip
Ransomexx
SOGO Auction
Ransomexx
Rogiken / institute of Science Tokyo
Coinbasecartel
earthprotect.co.jp
Lockbit5
HIGASHIYAMA INDUSTRIES Co.,Ltd.
Qilin
Aichi Electric
Thegentlemen
Nippon Medical School Musashi Kosugi Hospital
Netrunner
Shiraume Hospital
Netrunner

Frequently asked questions

How many ransomware attacks have occurred in Japan?

Japan has recorded 301 ransomware victim disclosures in this database, ranking #11 globally. This represents 1.3% of all tracked ransomware attacks worldwide.

Which ransomware groups target Japan?

The ransomware groups most active in Japan are Qilin, Thegentlemen, Safepay, Everest. These groups collectively account for the majority of victim disclosures attributed to Japan.

Which industries are most targeted by ransomware in Japan?

In Japan, the most frequently targeted sectors are Manufacturing, Technology, Agriculture and Food Production. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does Japan rank globally for ransomware attacks?

Japan ranks #11 globally for ransomware attacks with 301 victim disclosures, representing 1.3% of the worldwide total of 23,641 tracked victims.

How can organisations in Japan protect against ransomware?

Organisations in Japan should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Japan is also recommended.