Japan's ransomware record has one entry point

National statistics on ransomware are usually too aggregated to act on. Japan's are an exception, because the police publish the route the attackers took, and the route has not changed.

The National Police Agency said on Thursday that a record 123 ransomware cases were reported in the first half of this year. Kyodo News reported the agency's figures, which it has compiled every six months since the second half of 2020.

Virtual private network equipment was the most common infection route. That single detail is worth more than the case count, because it names a specific class of device rather than a category of human error.

A remote access appliance is an unusual piece of infrastructure: internet-facing by design, holding credentials by function, and frequently running firmware that is patched on a schedule set by convenience rather than by threat. It is also the thing an organisation is least willing to take offline.

The distribution of victims argues against reading this as a story about large enterprises. Of the reported cases, 79 targeted small and medium-sized companies, 31 targeted large corporations and 13 targeted other organisations.

Manufacturing accounted for the most cases at 37, which fits the pattern of a sector with long equipment lifecycles, remote maintenance requirements and production lines whose downtime is expensive enough to make payment look rational.

Recovery often took more than a month and was costly. That figure is the one to put in front of a board, because it converts a security question into an operational continuity question with a number attached.

A second measure in the same release describes the pressure rather than the outcome. Suspicious access detected at police internet connection points averaged a record 13,687 attempts per IP address per day, up more than 4,000 on the same period a year earlier.

Those attempts are reconnaissance, not intrusion. The number describes how thoroughly the internet-facing surface of a single organisation is examined every day, and it rose by roughly forty per cent in twelve months.

There is one piece of good news in the statistics, and it is concrete. The agency has recovered 20.11 million files using a decryption tool it developed itself, and has provided that tool to Europol for use in other countries.

The lesson transfers directly and costs nothing to act on. Most of these organisations did not fall to a novel technique. They fell through the appliance that grants remote access, which is the one device where a deferred patch and a reused credential meet the open internet.