A local manufacturer. A small accounting firm. A technology provider serving larger corporations. They may not dominate cybersecurity headlines, but each holds valuable information and maintains trusted business relationships.
New Japanese research shows why company size should not be mistaken for protection.
Cyber incidents involving smaller businesses have nearly doubled
According to Tokyo-based MM Research Institute, publicly reported cyberattack-related information exposures involving companies with 300 or fewer employees rose from 99 to 195 in January–September 2026 compared with the same period in 2025. These businesses accounted for 96 of the 150 additional reported incidents nationwide. [1]
Established in 1996, MM Research Institute is a private technology research and consulting organization. Its study reviewed company disclosures and reporting, checked for duplicates, and included cases of possible exposure. It measures reported incidents, not every attempted attack, and does not establish that an individual small business is more likely to be attacked than a large one.
Independent police data reinforces the scale of the issue: Japan’s National Police Agency reported 123 ransomware incidents in the first half of 2026, with 79 involving small and medium-sized enterprises. The police figures cover a different set of incidents and reporting period, so the two totals should not be combined. [2]
Supply-chain exposure: One company, many consequences
Smaller businesses are embedded in Japan’s manufacturing, logistics, professional services, and technology supply chains. They may support production at a major manufacturer, handle customer records, or manage software for numerous clients.
MM Research found that 164 incidents, or 36% of its January–September 2026 total across organizations of all sizes, involved external parties such as contractors and cloud providers. That does not mean attackers moved between companies in every case, but it shows how prominently third-party relationships feature in disclosures. [1]
Japan’s Information-technology Promotion Agency (IPA) provides independent evidence of the consequences. In a survey of 4,191 smaller businesses, 975 reported experiencing a cyber incident during fiscal 2023. Of those affected companies, approximately 70% reported an impact on their business partners. [3]
A disrupted parts supplier could delay a customer’s production. A compromised IT provider could expose data held for multiple clients. And a hijacked supplier email account could send convincing fraudulent payment requests through a trusted relationship. These are potential scenarios, not confirmed outcomes of the incidents counted in the studies.
The size of the company attacked does not necessarily determine the scale of the consequences.
When trusted business relationships become a target
An employee receives an email from a familiar supplier requesting new bank details. The sender’s name and invoice information appear correct. But if the supplier’s account has been compromised, an attacker may be communicating through a trusted channel.
Employees need to recognize unusual requests, verify payment changes through an independent channel, and report anything suspicious, even when a message appears to come from a long-standing business partner.
Accessible protection for smaller organizations
Many smaller organizations do not have dedicated cybersecurity teams or the resources available to major enterprises. Instead, they often rely on outsourced IT teams or managed service providers (MSPs) for their technology infrastructure and cybersecurity needs.
These providers can help make technical safeguards and ongoing digital-safety education more accessible. Businesses still need updated software, strong authentication, reliable backups, controlled access, and clear incident procedures. Employees need practical training grounded in the threats they actually encounter in Japan.
Education does not replace technical controls. It complements them by helping people recognize risks, exercise judgment, and respond safely.
Japan’s final 2024 Economic Census shows that 99.1% of its company enterprises have fewer than 300 regular employees. This measures company size, not Japan’s legal SME classification. [6] Reaching businesses at this scale requires education that is accessible, affordable, and Japan-native from the outset, designed around the language, workplace realities, and cyber threats employees face in Japan.
No business is too small to hold valuable information. And every business has a role in protecting the people and organizations connected to it.
Cybersecurity education for Japan’s smaller businesses
SAYA’s SMB Cybersecurity Education platform is designed specifically for smaller Japanese businesses, bringing practical Japan-native learning programs to employees through employers and trusted IT and security partners. To learn more, contact safety@sayauniversity.com.
