Japan's government has declared a state of emergency in cyberspace after a run of attacks on more than 20 major organisations, including a railway operator, a carmaker and discount retail chains.
Masaki Taira, who heads the ruling Liberal Democratic Party's National Cyber Security Strategy Headquarters, said Japan is currently in a state of emergency in cyberspace. Cyber security minister Toshiharu Furukawa called the situation extremely critical. An emergency meeting has been convened.
What leaked
Railway operator JR East says 1.67 million customer email addresses may have leaked from its booking system. IDC Frontier, a cloud services provider affiliated with SoftBank, was hit by ransomware.
The most consequential breach may be the quietest. The car rental firm Times Car holds a large store of digital photographs of driving licences in its app. After that data was exposed, experts expect the images to be sold cheaply on the dark web.
The regulator's response is the unusual part
Japan's financial services regulator has issued a strict warning to banks: stop accepting driving licences as proof of identity when opening new accounts.
That is a remarkable instruction, and worth sitting with. A government has concluded that a national identity document is no longer reliable for verification — not because the document changed, but because enough photographs of enough licences are now in circulation that possessing an image proves nothing.
This is the part of a data breach that does not get reported, because it has no dramatic moment. A leak is a single event; the devaluation of an identity document is permanent. The licences cannot be recalled and reissued at national scale, so the regulator removed the document from the process instead.
What it means in Bangladesh
The same exposure exists here, in a more concentrated form, and almost nobody treats it as a security question.
Photographs of the National ID card are routinely uploaded to get a mobile SIM, open a mobile financial services account, rent a flat, join a gym or register on a marketplace. Many of those holders are small firms with no security staff. The NID is also harder to replace than a driving licence and is used for more things.
The practical reading is not "stop sharing your NID" — that is not available to most people. It is narrower. Where a copy must be given, a crossed watermark naming the recipient and date makes a stolen image far less usable elsewhere. And any service that asks for an NID photograph but offers no way to verify by other means has made a decision about your risk, not theirs.
Bangladesh has run national cyber alerts before, covered here when CIRT warned of DDoS attacks. The Japanese case is a different and more durable kind of damage: not systems knocked offline, but a document quietly stripped of its meaning.
Why an identity document cannot be patched
Software breaches get fixed. Identity breaches get absorbed, and the difference is worth stating because it decides what a response can even attempt.
A leaked password is replaced in seconds. A leaked card is reissued in days. A leaked identity document is different in kind: the number does not change, the photograph does not change, and the holder cannot revoke it. Japan has roughly 80 million driving licence holders, and reissuing at that scale over a data breach is not an option any government has.
So the only lever left is the one the regulator pulled — stop relying on the document. That is why the instruction to banks is the real news rather than the leak itself. It is a government conceding that a verification method has been permanently degraded, and quietly moving the system around the damage rather than repairing it.
Source: Prothom Alo.
