Unauthorized access, ransomware, zero trust, and the safe use of AI. We explain what is happening now and what to do first, based on primary sources such as public agencies.
Articles that sort out vulnerabilities and official advisories for engineers and business leaders. Sources are cited next to each statement.
High-priority checks based on the notice issued on October 9, 2026 by IPA (Japan's Information-technology Promotion Agency, in Japanese) and on the major incidents of 2025.
01
List every website and app you run yourself, and every cloud or external service you use, including ones a single department signed up for. IPA says the starting point appears to be externally facing applications and services, or compromised accounts (IPA's notice).
02
Start with administrators and contractors. In the Askul incident, a contractor's administrator account had no multi-factor authentication, and it became the way in (IT Pro (Impress), in Japanese).
03
That includes your CMS, plugins, libraries, and runtimes such as PHP and Node.js. Both released critical fixes in October (our PHP article, our Node.js article, in Japanese).
04
Look back one month, then three, for spikes in failed logins and for accounts you don't recognize (IPA's notice).
05
Delete personal data and accounts you no longer use. IPA's basic principle is not to keep unnecessary information (IPA's notice).
06
Keep backups somewhere separate from production, and check that you can actually restore them. Askul explained that it had no backup environment designed with ransomware in mind, which prolonged recovery (IT Pro (Impress), in Japanese).
We are a design and IT company that builds websites and systems. We take requests such as:
We check which servers run which versions, then update them and verify that everything still works.
We check what is exposed, the login setup, APIs and logging, and sort out what to fix.
We decide together, before building, what privileges an AI gets, what data the system keeps, and where a person checks.
If you suspect a compromise, preserve your logs and bring in a specialist security vendor to investigate. IPA also strongly recommends asking a specialist vendor for a detailed investigation when anomalies are found (IPA's notice). What we do is check and fix the website and system side, and carry out updates and corrections.
This page summarizes public information from public agencies and others. It is not an individual assessment. Things change daily, so check each article and the official pages it cites for the latest.
43 W 33rd St, #202, New York, NY 10001
Phone: +1 (848) 281-7853
Email: info@supersonicdesign.com
