Japan Protective Security Report (Weekly)

Report: September 23 – September 30, 2026

🔒 Section 1: Weekly Security News Summary

Asian Games Security Operation Peaks as Games Enter Final Week

The National Police Agency's protective operation for the 20th Asian Games in Aichi and Nagoya remains the largest domestic security deployment of the year, with up to 10,000 officers mobilised per day and roughly 3,100 drawn from prefectural forces nationwide. Counter-terrorism preparation, bag inspections and screening at all venues, and coordination with the Japan Coast Guard on the maritime approaches form the core of the posture. Drone flights are banned within roughly one kilometre of ceremony venues and of accommodation used by athletes and dignitaries, under the revised drone law that took effect in July. The Emperor and Empress attended the opening ceremony on 19 September, and the Games run through 4 October.
Source: Nippon.com

💡Tips for Professionals:
Expect uniformed and plain-clothes density around Nagoya hotels to remain abnormally high until 5 October, which suppresses opportunistic crime but lengthens every vehicle movement and venue entry. Build screening time into principal schedules rather than assuming accredited access bypasses queues. If your principal is accommodated in a designated dignitary hotel, confirm whether the drone exclusion zone affects your own aerial reconnaissance or media drone plans, and brief drivers that parking and set-down points near venues may be reassigned at short notice.

Ransomware Hits Keio Group, Disrupting a Major Tokyo VIP Hotel

Keio Electric Railway disclosed on 26 September that group servers had been compromised by ransomware, with two servers confirmed affected. Keio Plaza Hotel in Shinjuku — a long-standing venue for visiting delegations and corporate principals — reported that enquiries submitted through its website form and through booking platforms could go unanswered or be delayed. Keio Store outlets lost credit card, e-money and loyalty point processing, and Keio Presso Inn and bus operations were similarly affected, while train services ran normally. As of midday on 28 September the company had not confirmed any ransom demand, and no data exfiltration had been established.
Source: Nikkei

💡Tips for Professionals:
Treat hotel system outages as an advance-work problem, not an IT problem: when a property's reservation and enquiry channels fail, room assignments, key issuance, billing privacy and secure-floor arrangements all become manual and therefore leakier. Reconfirm bookings and any privacy or alias arrangements by telephone with a named duty manager, and carry printed confirmations. Assume card payments may fail and hold sufficient cash for the movement. Where a principal's stay is already booked at an affected property, verify that VIP arrival protocols and loading-dock access have not quietly reverted to default public routing.

Breach Wave Across Transport and Mobility Operators, Including 6.6 Million Driving Licence Records

Times Mobility disclosed on 28 September that unauthorised access to its web system may have exposed up to about 6.6 million member records. Intrusion was detected at 09:07 on 25 September and the attacker's route and communications were severed by 07:25 the next morning. Exposed data may include names, addresses, dates of birth, telephone numbers and email addresses, together with driving licence details and uploaded images of licences and student identity cards — covering former members and incomplete registrations. Card data was not affected and passwords were stored irreversibly. Separately, Tokyo Metro announced on 27 September that roughly 59,000 email addresses held for its Metpo points service may have leaked following access believed to originate overseas; only suspended or undeliverable addresses were held on that server, and rail operations were unaffected. Similar disclosures came from Seicomart and Nippon Rent-a-Car in the same period.
Source: Nikkei and NHK

💡Tips for Professionals:
Leaked licence images are identity-document-grade material, not ordinary contact data: they enable convincing impersonation of a principal or a driver at hotel check-in, car rental counters and vehicle collection points. Audit which mobility and rental accounts your team holds under principals' or executives' real names and consider moving to corporate accounts under the security entity instead. Strengthen call-back verification for any inbound request that cites licence details as proof of identity, and brief close-protection drivers that a caller quoting a licence number is not thereby authenticated.

First Arrest of a Target-Intelligence Supplier Feeding "Tokuryū" Robbery Crews

The Metropolitan Police Department announced on 29 September the arrest of a self-described real estate operator, aged 53, on suspicion of attempted robbery and trespass — its first arrest of an information supplier in a case involving an anonymous, fluid criminal network. Investigators believe he obtained a couple's address, household composition, asset levels and the location where cash was kept during a property consultation around spring 2024, then passed the targeting package by social media to an acquaintance already indicted as a "case broker," including that cash was in the safe and amounted to roughly 50 million yen. The broker is said to have recruited the actual perpetrators through an intermediary.
Source: Jiji Press

💡Tips for Professionals:
This is the clearest recent evidence that Japanese residential robbery crews now buy structured target dossiers from insiders in legitimate professions. Treat property agents, renovation contractors, relocation firms, private bankers and domestic staff as a named leakage channel in your residential threat assessment, and limit what any one of them learns about safe locations, alarm layout and occupancy patterns. Where a principal has recently transacted on property or discussed assets with an intermediary, raise residential posture for the following months: vary routines, verify that safes are not visible during any viewing or works, and confirm that alarm and CCTV coverage was not disclosed to vendors.

Company Executive Stabbed in Tsukuba; Five With Employment Ties Arrested

A company executive in his twenties was stabbed in the back in Tsukuba, Ibaraki Prefecture, on 22 September and was left in a serious condition; he reported the attack himself. Ibaraki police subsequently arrested five people on suspicion of attempted murder, among them a scaffolding worker resident in Ryūgasaki. All five are reported to have had employment relationships with the victim or with the company in which he held office. No motive has been publicly stated.
Source: NHK

💡Tips for Professionals:
A coordinated attack by five people with employment ties is an insider-threat case, not a stranger-violence case, and it is the pattern that corporate protective programmes in Japan most consistently under-resource. Grievance emerging from labour disputes, dismissals, subcontractor payment conflicts or site-level friction deserves the same escalation pathway as an external threat: route it to security, not only to human resources. For principals who visit operational sites, plants or subcontractor premises, treat the site visit as the highest-risk movement in the diary, control advance notice of timing, and avoid predictable solo arrival and departure at company premises.

Gunma Homicide Triggers Nationwide Manhunt Ended at a Pachinko Parlour

Shortly after midday on 25 September, a woman in her fifties was found bleeding at her home in Ōta, Gunma Prefecture, by her returning son and daughter, and was later confirmed dead. A man present at the scene slashed the son with a knife and fled. Police obtained an arrest warrant and circulated the suspect publicly; on 27 September the 30-year-old former husband of the woman's eldest daughter was located and arrested at a pachinko parlour in Takasaki. On 29 September a further kitchen knife was recovered near the scene, suggesting more than one blade had been used.
Source: NHK

💡Tips for Professionals:
Former partners of family members remain the most common source of lethal, motivated, address-aware violence at private residences in Japan, and the threat travels through the extended family rather than the principal alone. When conducting a family threat assessment, map former spouses and partners of adult children and household staff, not only of the principal. Note also that the subject remained at large for two days in a neighbouring city and was found in a crowded leisure venue: during an active manhunt, brief protected families to avoid publicising their location and to treat unexpected approaches at home as a police matter immediately.

NPA Designates New Drone No-Fly Facilities for Tokyo Equestrian Venue and National Sports Games

The National Police Agency published a designation on 25 September bringing Baji Kōen — the Asian Games equestrian venue in Setagaya Ward, Tokyo — within the scope of the law prohibiting drone flight over the surrounding airspace of important facilities, as a site where specially protected dignitaries will be present. A parallel designation covering facilities for the 80th National Sports Games followed on 29 September, and an earlier designation on 7 September covered the Asian Games themselves.
Source: National Police Agency

💡Tips for Professionals:
These designations are a reliable, publicly available indicator of where senior Imperial Family members or equivalent protected persons are expected, often before schedules are announced — a useful planning input when deciding whether a principal's own movement will collide with a full protective cordon. Operationally, the restriction applies to your team as much as to hostile operators: any aerial survey, media drone or event-filming plan near a designated site needs to be cancelled or cleared with the relevant prefectural police in advance, and subcontracted media crews should be briefed explicitly.

NPA Details North Korean "Headhunting" Attacks Aimed at Engineers

Following the four-nation public attribution issued with the United States, Australia and Germany on 18 September, the National Police Agency and the National Cyber Office set out during the past week how the North Korea-linked group WaterPlum operates. The group impersonates artificial intelligence firms, cryptocurrency and NFT businesses and recruitment agencies, approaching software developers and engineers as headhunters and inducing them to run malicious code as part of purported technical interviews or coding tests. Between around December 2025 and July 2026 more than 30,000 devices in over 100 countries and regions were infected, credentials for more than 7,000 cryptocurrency wallets were stolen, and roughly 1.7 billion yen in cryptocurrency was traced to wallets under the group's control. The NPA and FBI assess the group as operating under the 313 bureau of the Workers' Party munitions industry apparatus.
Source: National Police Agency

💡Tips for Professionals:
Social-engineering approaches dressed as career opportunities are the most effective current route into a protected person's wider circle, and executives' technical staff, family offices and personal assistants are all plausible targets. Brief protected households and support staff that an unsolicited recruiter asking them to download, run or debug anything is a hostile act, regardless of how credible the company appears. For teams handling principals in technology or digital-asset sectors, assume recruitment-themed approaches are active reconnaissance and route them to your cyber or corporate security function for logging.

🌏 Section 2: Japan–Foreign Nations Tension Monitor

1. China – Tension Level: High

Relations remain badly strained since Prime Minister Takaichi's November remarks on a possible Taiwan contingency. On 29 September a Japanese trade delegation led by former Foreign Minister Takeshi Iwaya met Vice Premier He Lifeng at the Great Hall of the People in Beijing — the highest-level engagement with a Japanese political figure since the rupture. He warned that some Japanese politicians are attempting to cross China's red line on Taiwan, while stressing that the two economies remain important partners and that Chinese investment remains open to Japanese firms. Three days earlier, on 26 September, Takaichi held a 20-minute call with President Trump — their second engagement in a week after meeting in New York on 22 September — in which Trump briefed her on his meeting with President Xi and the two confirmed continued cooperation on China-related economic security and defence. Around the Senkaku Islands, China Coast Guard vessels continue to enter and navigate the contiguous zone on a near-daily basis outside severe weather, with territorial incursions recurring several times a month.
Source: Nippon.com and Japan Coast Guard

💡Tips for Professionals: Assume anti-Japanese and anti-Chinese sentiment can be mobilised quickly on either side, and that the Chinese Embassy and consulates in Japan, together with Chinese-linked commercial premises, remain elevated protest and single-actor risk locations. For principals of Chinese nationality or with prominent China business exposure, keep arrival and departure at diplomatic and trade venues low-profile and unpublicised.

2. North Korea – Tension Level: High

On 20 September the Ministry of Defense reported two ballistic missile launches from North Korea's east coast, flying roughly 440 kilometres at an apex of about 60 kilometres and roughly 590 kilometres at an apex of about 70 kilometres respectively; both fell outside Japan's exclusive economic zone and no damage was reported. It was the ninth launch event attributed to North Korea in 2026. On 28 September a North Korean vice foreign minister used the UN General Assembly to accuse Japan of accelerating rearmament and casting war clouds over the Korean Peninsula. The 18 September four-nation attribution of the WaterPlum cyber group adds a persistent non-kinetic dimension directed at Japanese targets.
Source: Ministry of Defense and NHK

💡Tips for Professionals: Launches on this profile generate J-Alert and broadcast disruption rather than physical risk, but they reliably disrupt rail and early-morning airport operations in northern and western Japan for tens of minutes. Ensure principals and drivers know that an alert is an instruction to seek substantial cover indoors, not to accelerate a movement, and pre-agree a hold location for each leg of any itinerary transiting Tōhoku, Hokkaidō or the San'in coast.

3. Russia – Tension Level: Elevated

No discrete Russian incident against Japanese territory was reported during the period, but the structural picture continues to harden. Japan's latest defence white paper warns that deepening military coordination between China, Russia and North Korea is raising security risks for Japan, citing increasingly assertive joint Chinese-Russian bomber patrols and Moscow's support for North Korean military modernisation, with Pyongyang gaining political, economic, technological and military benefit in exchange for backing Russia's war effort. The first road bridge linking Russia and North Korea opened on 8 September. Earlier in 2026 Chinese and Russian forces conducted gunnery exercises inside Japan's exclusive economic zone southwest of Okinotorishima.
Source: Nikkei Asia and Nikkei

💡Tips for Professionals: The practical exposure for protective teams is around the Russian Embassy in Minato Ward and Russian-linked commercial and cultural premises, where right-wing sound-truck activity and counter-protest remain routine. Where an itinerary touches Hokkaidō or the Nemuro area, note that maritime and fisheries friction can produce short-notice local media attention and police presence.

🌋 Section 3: Natural Disaster Report

1. Typhoon No. 25 Aftermath — Chiba and Kanagawa Flooding and a Reservoir Levee Breach

Record rainfall associated with Typhoon No. 25 left 11 people dead and three missing across Chiba and Kanagawa prefectures as reported on 23 September, with widespread inundation from both landslides and river overflow. The embankment around Kita-Inba-numa in Chiba Prefecture failed, sustaining flooding across surrounding areas including Narita and Inzai; two breach points were initially confirmed and a third was found by 24 September. Approximately 997 residential structures sustained damage, and a submerged solar power facility near the reservoir caught fire. On the transport side, the Tokyo Metro Tōzai Line was suspended between Kasai and Kayabachō, with service restored by 30 September.
Source: NHK

2. Typhoon No. 26 (Surigae) — Izu Islands Impact, 30 September to 1 October

Typhoon No. 26 was tracking north-east over the ocean south of Japan at the end of the period, remaining offshore of the main islands rather than making landfall. The Izu Islands — part of Tokyo Metropolis — face the most severe conditions, with strong winds and high seas expected across the southern islands including Hachijōjima and Aogashima from the afternoon of 30 September through the morning of 1 October. Kantō avoids direct typhoon effects but continues to see rainfall from an autumn frontal system to the south, over ground already saturated by Typhoon No. 25.
Source: Japan Meteorological Agency

3. Seismic Activity — No Event at Intensity 5-Minus or Above

No earthquake reaching a maximum seismic intensity of 5-minus or greater was recorded in Japan during the reporting period. The most strongly felt event was on 26 September at 10:31, magnitude 4.5 in the Kumamoto region of Kumamoto Prefecture, maximum intensity 4, followed by a magnitude 3.6 aftershock at 11:21. On 28 September a series of smaller events between magnitude 2.7 and 3.5 was recorded off Iwate and Miyagi and in Chiba, Kumamoto and the Aizu region of Fukushima, none exceeding intensity 1 to 2. No volcanic eruption requiring a raised alert level was reported.
Source: Japan Meteorological Agency

💡Tips for Professionals:
Chiba remains the operationally degraded area: with a reservoir levee still under emergency repair and saturated ground, secondary flooding and localised road closures on routes into Narita and Inzai are realistic through early October, which directly affects Narita Airport ground movements. Build meaningful buffers into airport transfers via Chiba, hold an alternative Haneda routing, and confirm the Tōzai Line has resumed normally before relying on it for a principal's movement. For any travel to the Izu Islands, treat 30 September and 1 October as non-viable for ferry and air links and plan around the cancellation rather than the schedule. Register for Japan Meteorological Agency warnings and prefectural evacuation alerts for every prefecture on the itinerary, not only the destination.

📅 Section 4: Upcoming Major Events & Traffic Restrictions

Tokyo

• Asian Games Equestrian Competition, Baji Kōen – 30 September to 4 October 2026; show jumping on 1, 3 and 4 October
  • Location: Baji Kōen, Setagaya Ward, south-western Tokyo
  • Traffic: No wide-area road closure has been published. Gates open between roughly 07:45 and 10:30 with competition starting between 09:15 and 12:00, concentrating arrivals into narrow morning windows and congesting local approach roads in the Setagaya and Yōga area. A drone flight prohibition is in force over the surrounding airspace as a designated dignitary-presence facility.
  • Source: Asian Games 2026 Official and National Police Agency
• Extraordinary Diet Session Convenes – 5 October 2026, running 69 days to 12 December
  • Location: National Diet Building, Nagatachō, Chiyoda Ward
  • Traffic: Prime Minister Takaichi delivers her policy speech in the House of Representatives on 5 October, with party representative questions on 7 and 8 October. Expect intensified Metropolitan Police presence, vehicle checks and protest and sound-truck activity across Nagatachō and Kasumigaseki on those dates, with contentious consumption tax and Lower House seat reduction bills on the agenda raising the likelihood of organised demonstrations.
  • Source: NHK
• No large-scale scheduled road closure in this window
  • Traffic: As of 30 September the Metropolitan Police Department's event traffic-restriction page lists no city-wide closure inside the reporting window; the next major closure is the Tokyo Legacy Half Marathon on 20 October, which will close Yasukuni-dōri and Gaien-nishi-dōri to vehicles, cyclists, pedestrians and electric scooters.
  • Source: Metropolitan Police Department

💡Tips for Professionals: Tokyo's constraint this week is Nagatachō on 5, 7 and 8 October rather than any road closure. Route principals with appointments in Chiyoda Ward away from the Diet perimeter on those mornings, and add 20 to 30 minutes for checkpoint delay if the destination is inside it. For the Setagaya equestrian venue, arrive well before the gate window rather than at it, and pre-agree a set-down point away from the main spectator approach.

Nagoya / Aichi

• Asian Games Closing Ceremony – 4 October 2026, 18:00
  • Location: Paloma Mizuho Stadium, Mizuho Park Athletic Stadium, Mizuho Ward, Nagoya
  • Traffic: Identity verification opens at 13:00 and gates at 13:30; a warm-up stage begins at 16:00, after which venue entry is restricted, with the entry restriction period provisionally 16:30 to 17:40. Spectators arriving after the warm-up stage begins will not be admitted. Temporary traffic restrictions apply in parts of Nagoya, with detailed closure maps published by Aichi Prefectural Police and the city. Severe congestion is expected around Mizuho Park, compounded by concurrent competition at other venues.
  • Source: Asian Games 2026 Official and Aichi Prefectural Police
• Asian Games Competition Continues – through 4 October 2026
  • Location: Venues across Aichi Prefecture and Nagoya
  • Traffic: The national police operation of up to 10,000 officers per day remains in force, with venue screening and maritime coordination continuing to the close of the Games.
  • Source: Nagoya City

💡Tips for Professionals: The 16:30 entry cut-off on 4 October is a hard operational deadline, not a guideline: a principal attending the closing ceremony must be inside the perimeter before the warm-up stage, which in practice means departing the hotel in the early afternoon. Plan the extraction as carefully as the arrival — post-ceremony egress from Mizuho Park will be the single worst congestion point of the Games, and a pre-positioned vehicle outside the restriction zone with a walked link route is preferable to a nominal VIP set-down that police may relocate on the day.

Aomori

• 80th National Sports Games, "Ao no Kirameki Aomori Kokusupo" – pre-session II competitions 2 to 9 October 2026
  • Location: Venues across Aomori Prefecture; main session 10 to 20 October with the grand opening ceremony on 10 October at Maeda Arena
  • Traffic: Localised restrictions around individual competition venues. The National Police Agency designated drone no-fly facilities for the Games on 29 September, indicating expected senior dignitary attendance during the main session.
  • Source: Aomori Prefecture Official and National Police Agency

💡Tips for Professionals: Aomori's hotel inventory is thin and will be absorbed by team and official delegations from early October, so accommodation and vehicle hire for any principal travelling to the region should be secured immediately rather than closer to the date. Expect reduced availability of local protective and driver resources for the same reason.

Osaka

• SAKANA & JAPAN FESTIVAL 2026 – 2 to 4 October 2026
  • Location: Expo '70 Commemorative Park, Suita
  • Traffic: No road closure published; expect heavy weekend congestion on park approach roads and at Bampaku-kinen-kōen station, with car park saturation from mid-morning.
  • Source: Expo '70 Commemorative Park Official

💡Tips for Professionals: Park-venue events in the Kansai region concentrate crowding at a single station and a single car park rather than on the road network, so the risk is pedestrian density at the transition from vehicle to venue. Set down away from the main gate and walk the final approach, and fix a rally point inside the park before entering.

Japan Protective Security Report (Weekly)
This report is based on open-source intelligence (OSINT) gathered from publicly available, high-credibility sources. It does not constitute legal advice, and CCTT INC. makes no warranty regarding completeness or accuracy. Operational decisions should always incorporate real-time local intelligence.

CCTT INC. – Protective Security Service, Tokyo Japan
VIP/Executive Protection | Celebrity Protection | Vehicle and Driver Arrangement | Airport Service Arrangement | Security Consulting | Security Management | Security Education/Training, etc.

https://www.cctt.jp/