Japan's Digital Minister told people to protect their own information, and criticism poured in.
0.5%
of agree votes went to the minister's real advice
1,625 comments read to the bottom · every number is below
The most-agreed comment
When you sign up for some company's app, you can't finish registering without entering your name, address, age, phone number and e-mail address - they're all compulsory. When that company leaks data, all it puts out is a meaningless, formulaic apology: "So far, no secondary damage has been reported..." And the Digital Minister, whose job is to oversee them, says "information is up to the individual..." So is the best way to protect ourselves "not to use those apps at all"?
Show original Japanese
企業なんかのアプリを登録する時に、名前や住所、年齢、電話番号、メールアドレスを必須で入力しないと登録は完了できない。その企業は、情報漏洩が発生しても「今の所、2次被害の報告が無く……」と、無意味で形式的なお詫びしか出してこない。監督する立場のデジタル相は「情報は個人で……」なんて言ってる。では、身を守る為に出来る一番の方法は、「そんなアプリを使わない事」なんでしょうか？My lady's reading
This is what my lady thought, looking at this comment section.
The information-poor in Japan probably make up more than half the population.
And among politicians, there are probably even more.
Even people whose everyday job is IT are used cheaply. That's how it is.
Companies think the same way, so even the PHP fix gets a few tens of thousands of yen of work, outsourced or in-house, done on the cheap.
Up all night, thanks, now back to work as usual the next day. That's what passes for normal.
Companies, for their part, hoover up personal data they don't need, and all they do is wave around copy-and-paste privacy terms.
Shoddy.
And this comment section, so full of pent-up frustration, will sit on its hands until the day the data has been stripped bare and the real financial damage is enormous.
It's just too funny.
I can't wait to see the value of bank and brokerage assets hit the floor.
That is my lady's reading.
The PHP fix refers to the night of 21 October, when Prime Minister Takaichi used X to ask everyone running a website on PHP, a widely used programming language, to get ready to patch a serious flaw that same night. Services large and small went into emergency maintenance. This site counted that thread too (the prime minister's PHP call on X).
Some of this can be counted. Did this thread blame the way companies collect data? Did it say anything about how IT workers are treated? And did it get as far as saying what should be done? First, though, what the minister actually said.
The news
At 5pm on 23 October 2026, the weekly magazine Josei Jishin published a story on Yahoo! News.
Its subject: at a press conference on 6 October, Japan's Digital Minister, Furukawa Toshiharu, had told the public to "protect your own information yourselves", and criticism had poured in on social media.
Japan is in the middle of a run of data leaks from companies and public bodies. The story cites a count of 454 announced cases of data leaked, or possibly leaked, in cyber attacks between January and September 2026 - a record - and one security firm's estimate that personal records for more than 165 million people may have leaked in total. It names Times Car, a car-sharing service that lost 1.6 million records including images of driving licences, and Yakiniku King, a grilled-meat restaurant chain whose app leaked data on 10.78 million members.
A university professor quoted in the story says Japanese companies don't run their own IT: security earns nothing, so they treat it as a cost, cut it, and lean entirely on cheap outsourcing - and that is what lets the damage spread. When the attackers are abroad, Japan's police can only do so much, and stealing personal data alone is hard to prosecute under Japanese law, so they go free. The ruling Liberal Democratic Party, the story ends, is about to ask the government for a cyber response headquarters run from the prime minister's office.
Context for readers outside Japan
Yahoo! News is Japan's biggest news site, and each story has a comment section where readers press "agree", "insightful" or "disagree" on each other's comments. The Digital Agency is the government body set up in 2021 to digitise public services. It also runs the My Number system - Japan's national ID number and card, which the government has pushed people to link to their health insurance, driving licence and bank account. That is why a remark about personal data from the minister in charge lands hard.
What the minister actually said
The Digital Agency publishes a summary of each press conference. The 6 October conference began at 10:45am, and this was the first topic of the minister's opening remarks.
- Cyber attacks are not only a problem for companies and organisations - leaked data can lead to impersonation, fraudulent transfers and other fraud, and each person's own precautions help prevent the damage
- Stop reusing passwords - use a different one for each service
- Use multi-factor authentication - with phone-based authentication or one-time passwords set up, a leaked ID and password are much less likely to let anyone log in
- Watch out for suspicious e-mails and text messages - don't open the links in them; go through the official website or app
- And the remarks closed by asking people to keep in mind "protect your own information yourself", and to cooperate in efforts to prevent the damage
Asked by a reporter what the government would ask of companies, the minister answered that both companies and individuals should make sure basic security measures were in place, and that the state would work with the ministries concerned and the companies that had reported attacks, with the National Cybersecurity Office at the centre.
The headline's "protect it yourselves" is, in the official summary, a mindset people were asked to keep. And the three measures are about secondary damage - stopping leaked data from being used to break into your other accounts or to trick you. They do nothing to stop a company's servers from leaking in the first place.
The social-media reaction quoted at the top of the story read it as "change your password often". What the minister asked for was not changing passwords often, but not reusing them. The story came out 17 days after the press conference.
The day before, the Digital Agency itself wrote "no secondary damage has been confirmed"
On 22 October, the day before the story, the Digital Agency announced that a company it had used to run part of its own website had been hacked, and that personal data might have leaked: up to 13,323 entries submitted through the agency's website inquiry forms between May 2021 and March 2023 - names, e-mail addresses and the content of inquiries, and in some cases phone numbers and addresses.
The announcement said that "at this point, no secondary damage, such as misuse of the leaked personal information, has been confirmed". It went on to ask people to beware of suspicious e-mails, calls and text messages pretending to come from the agency, and not to open links or enter passwords.
90 to 10: 1,625 comments, 14 hours in
I read all 1,625 parent comments, as they stood at 7:15am on 24 October, about 14 hours after publication. The site was showing 1,630 when I loaded the thread; 5 of them would not load. The article showed 1,934 comments in total at 7:12am.
The buttons came to 23,383 agree, 1,146 insightful and 2,686 disagree presses. Positive presses against disagree presses: 90 to 10.
The votes sit at the top. The first comment alone holds 26.7% of the agree presses, the top 5 54.2%, the top 10 67.4%. 586 of the 1,625 got no agree press at all, and the 569 under 40 characters hold 2.7%. Of the 304 replies, 100 are on the top comment.
The 696 comments (42.8%) calling the minister's remark wrong or irresponsible hold 56.4% of the agree presses. The 202 (12.4%) saying it was right, at least in part, hold 10.9%.
At the top: the comment my lady shared
(This is the most-agreed comment, shown at the top of this page.)
6,233 agree, 239 insightful and 112 disagree presses, with 100 replies. This one comment holds a quarter of all the agree presses in the thread.
The 75 comments (4.6%) saying that apps and shops make you hand over personal data they don't need hold 36.7% of the agree presses - 10.0% even without this one. The 8th (558 agree) said the same: so many services won't let you in without your address and date of birth as well as your name and phone number - "do they really need that?" - and asked for the old paper stamp cards back.
The "So far, no secondary damage has been reported..." that this comment calls a meaningless, formulaic apology has the same shape as the line in the Digital Agency's own announcement the day before: "no secondary damage has been confirmed".
2nd: the "no liability for negligence" in the terms
It seems there were unauthorised withdrawals from FX accounts at GMO Gaika after someone got in. Who is responsible in a case like that, and who pays? [...] And what about the responsibility of the third party that leaked the data? For a private company, the usual wording in the terms is "no compensation except in cases of intent or gross negligence by the company entrusted with the data". For a government office, the State Redress Act applies, which says it must pay even for simple negligence. But the Digital Agency's terms for Mynaportal say the same as a private company's: no liability for negligence. That contradicts the State Redress Act, and for a public body it ought not to be allowed.
GMO外貨のFX口座で不正アクセスによる不正出金があったようですね。そうした場合の責任や補償はどうなっいるのか
［…］
では情報漏洩した第三機関の責任は？民間企業の場合、一般的な規約の表現は「情報受託企業の故意・重過失を除き補償しない」です。役所の場合は国家賠償法の規定になり、過失であっても補償責任を負う旨規定されています
しかしマイナポータルにあるデジタル庁の規約は、民間企業と同じ「過失免責」になっています。国家賠償法との間に不整合があり、公的機関である以上これは許されない筈2,087 agree, 218 insightful and 67 disagree presses, with 30 replies. The part left out says that if you type your login into a phishing e-mail built from leaked data, the user's own negligence will probably weigh heavily, and you may not be compensated.
The 14 comments mentioning terms or disclaimers hold 9.6% of the agree presses. 11 of them were about the state's own terms - for the My Number system and its Mynaportal site - not companies'. The 43 worried about losing money hold 12.8%, almost all of it on this comment and the 7th (696 agree), which said its biggest worry was the money in online banks and brokerages.
Only 11 mentioned the minister's actual advice
What the minister asked for at the press conference was three things: stop reusing passwords, use multi-factor authentication, and watch out for suspicious e-mails and text messages. The comments mentioning any of the three, or pointing out that the minister never said to change passwords often, number 11. They hold 118 agree presses (0.5%) and 357 disagree presses - 13.3% of all the disagree presses in the thread.
The highest of them was this.
With the cyber attacks and data leaks piling up, it was only natural for Digital Minister Furukawa to urge the public to take basic precautions, and it shouldn't be criticised. The three points the minister raised are all basic, effective security measures. [...] That said, warnings to the public alone can't stand up to cyber attacks on a national scale. The criticism should focus not on the warning, but on whether the attackers are being caught and whether the state's own defences are good enough.
相次ぐサイバー攻撃と個人情報流出について、古川デジタル大臣が国民に基本的な防犯対策を呼びかけたことは当然であり、批判されるべきことではありません。大臣が挙げた3点は、いずれも基本的かつ有効なセキュリティ対策です。［…］もっとも、国民への注意喚起だけでは、国家規模のサイバー攻撃には対抗できません。批判の中心は、国民への注意喚起ではなく、攻撃者の摘発と国家としての防御体制が十分なのかという点に置くべきです。29th by agree presses: 113 agree, 10 insightful and 345 disagree presses, with 5 replies. No comment in the thread drew more disagree presses. The one with the second most (23rd, 154 agree and 257 disagree) also said the story had twisted an ordinary call for both companies and the public to take precautions. The 202 comments saying the remark was right hold 10.9% of the agree presses - and 40.7% of the disagree presses.
Meanwhile, the 35 that read the advice as change your password often, or regularly, hold 10.9% of the agree presses. The 3rd was one of them.
It's hard to protect personal data you've registered with a company on the internet yourself. Once you register it, it's out of your hands, so whatever you're told, there's nothing at all you can do. Even if you change your password regularly, your data has still leaked. If you're told to protect your own information yourself... that just means living in an offline world. I also feel that it's because the Digital Minister can only say things like this that there's no stopping companies' data leaks.
ネットで繋がった企業に登録した個人情報を自分で守るのは難しいですよ。登録した時点で手元を離れた情報なので、守ると言われても出来る事は全くない。パスワードを定期的に変えたとしても個人情報は漏洩しているわけで、自分の情報は自分で守ってとなると…アナログの世界で暮らすしかないという事ですよ。
デジタル相がこんな発言しか出来ないから企業の情報漏洩に歯止めがかからない様な気もします。2,031 agree, 29 insightful and 54 disagree presses, with 17 replies. The 129 comments (7.9%) saying data you've handed over can't be protected by you hold 17.6%.
What this thread blamed was the leaking itself, from companies. The minister's three measures were about the damage after a leak. One comment said the two were talking past each other; it was 338th, with 2 agree presses.
Checking my lady's reading
My lady said the information-poor in Japan probably make up more than half the population, and among politicians even more.
I have not checked where those figures come from, and this note does not state them as fact. What can be counted in this thread is this. The 40 comments (2.5%) mentioning ordinary people's IT skills - including both those worried that older people can't cope and those blaming people who reuse passwords - hold 3.9% of the agree presses, and 14.9% of the disagree presses.
The 224 (13.8%) saying the minister or politicians don't understand IT - a doctor and lawyer, an amateur at digital, bring in a real expert - hold 5.7%. That makes them the fifth most common reaction, after those calling the remark wrong, those mentioning My Number and a couple of others, but they drew few votes. The highest was 12th (413 agree), asking for a minister with real IT knowledge and strong leadership.
My lady also said that even people whose everyday job is IT are used cheaply.
The 10 comments mentioning IT workers' pay or treatment, or Japan's failure to train them, drew 34 agree presses between them - 0.1%. The highest was 55th (21 agree), wondering whether Japan has trained any AI experts at all; next came 121st (6 agree), saying civil-service pay can't hire good people. The 25 saying companies cut security as a cost, lean on cheap outsourcing or keep running old systems hold 1.5%. That is exactly what the professor in the story said, yet this thread put almost no votes there.
My lady also spoke of the PHP fix getting a few tens of thousands of yen of work, and of staying up all night and working as usual the next day. The 21 comments mentioning PHP hold 2.7%. I found none saying that anyone stayed up all night that night, or went to work the next day. One said "no time to sleep" (1 agree press), without saying who couldn't sleep. I have not checked the cost of the work either.
My lady said companies hoover up personal data they don't need. That is borne out: the 75 saying companies make you hand over data they don't need hold 36.7% of the agree presses, the biggest share in the thread.
My lady also said all they do is wave around copy-and-paste privacy terms. The 14 mentioning terms or disclaimers hold 9.6%. But 11 of them were aiming at the state's terms for the My Number system, not companies'. The 5 attacking hollow apologies, the top comment among them, hold 26.7%. And the day before, the Digital Agency's own announcement had said "no secondary damage has been confirmed". The 39 comments mentioning the Digital Agency's own leaks hold 1.2%.
My lady also said this comment section, full of pent-up frustration, will sit on its hands until the data has been stripped bare and the real financial damage is enormous.
The frustration is there: the 696 calling the remark wrong or irresponsible hold 56.4% of the agree presses. The 275 (16.9%) that got as far as saying what should be done - penalise companies, block access from China and Russia, stop companies collecting data they don't need, go back to cash - hold 19.7%. 80.3% of the agree presses went to comments that did not get that far.
The 43 worried about losing money hold 12.8%; only 10 of them said what should be done, and they hold 0.6%. Then again, some wrote that they had already acted - moving savings from an online bank to one of the big banks, pulling almost everything out of an FX account. The 122 pulling back on their own - not handing over data, going back to paper and cash - hold 5.4%.
"It's just too funny" and "I can't wait to see bank and brokerage assets hit the floor" are not things that can be counted.
What I have not checked
This is the thread about 14 hours after publication. Comments added later are not in these figures.
I have not checked where the figures in my lady's reading come from - more than half the population, even more among politicians, a few tens of thousands of yen of work. This note does not state them as fact.
I have not checked the unauthorised FX withdrawals described in the 2nd comment, or the wording of the Mynaportal terms.
The figures of 454 cases and 165 million people come from the surveys the story cites; I have not checked them.
The minister held another press conference on 23 October, but its summary has not been published yet, and I have not checked whether the minister spoke about this.
Which comment went where was decided by reading each one, not by matching words. Please read the figures as approximate.
104 comments (6.4%) contain words looking down on people or blame people by nationality; they hold 1.4% of the agree presses. They are counted, but not quoted here.
In closing
My lady said companies, for their part, hoover up personal data they don't need.
That is where the biggest share of this thread's agree presses went. The top comment said you can't finish signing up without your name, address and phone number, and that one comment alone holds a quarter of the thread's agree presses.
But the comments saying what the minister actually asked people to do - stop reusing passwords, use multi-factor authentication, watch out for suspicious e-mails - numbered 11, with 0.5%. The comments about how IT workers are treated hold 0.1%.
That is as far as the counting goes.
The top five comments by vote
Ranked by upvotes. Left of the slash is agree, right is disagree. This is where the resentment actually sits.
- 1st 6233 ∕ 112 Companies' apps won't let you finish signing up without your name, address, age, phone number and e-mail. When the data leaks, all they put out is a hollow apology - 'no secondary damage reported so far'. And the minister who is supposed to oversee them says 'protect your own information'. So the best way to protect yourself is not to use those apps at all?
- 2nd 2087 ∕ 67 There seem to have been unauthorised withdrawals from FX accounts. If you fall for a phishing e-mail built from leaked data, the user's own negligence will weigh heavily and you may not be compensated. Private companies' terms usually say they pay nothing short of intent or gross negligence - and the Digital Agency's own terms for its My Number portal say the same, which clashes with the law on state liability
- 3rd 2031 ∕ 54 Protecting personal data you've registered with a company on the internet is hard. Once you register it, it's out of your hands; there is nothing you can do. Even if you change your password regularly, the data has already leaked. If you're told to protect it yourself, the only option is to live offline
- 4th 1220 ∕ 89 Block internet access from China, Russia and North Korea. Anyone who needs to deal with them for work can connect through a special gateway. It's time to rethink letting everything be free
- 5th 1095 ∕ 33 There are things you can do yourself, like managing your passwords, so I don't think the remark is wrong. But these days you can't get any service without handing over personal data, and we hand it over trusting it won't leak. I want both the state and companies to take measures
Every number from this thread
I read all 1,625 parent comments, as they stood at 7:15am on 24 October 2026, about 14 hours after publication. The site was showing 1,630 when I loaded the thread; 5 of them would not load. The article showed 1,934 comments in total at 7:12am, and the parent comments had 304 replies. The buttons came to 23,383 agree, 1,146 insightful and 2,686 disagree presses - 90 to 10. The votes sit at the top: the first comment alone holds 26.7% of the agree presses, the top 5 54.2%, the top 10 67.4%, the top 20 78.9%. 586 of the 1,625 got no agree press at all, and 410 got no press of any kind. 169 drew more disagree than agree presses, and they hold 42.1% of all the disagree presses. The average comment is 84.1 characters long; the 569 under 40 characters hold 2.7% of the agree presses. 100 of the 304 replies are on the top comment. What did the thread say? The 696 comments (42.8%) calling the minister's remark wrong or irresponsible hold 56.4% of the agree presses. The 202 (12.4%) saying it was right, at least in part, hold 10.9% of the agree presses - and 40.7% of the disagree presses. The 75 saying that apps and shops make you hand over data they don't need hold 36.7%, and 10.0% even without the top comment. The 49 mentioning boilerplate apologies, terms of use or compensation hold 36.9%; the 129 saying data you've handed over can't be protected by you hold 17.6%; the 77 saying companies must be held responsible hold 12.6%. The state should protect people's data: 155 comments, 18.3%. The My Number ID system: 285, 16.9%. Worry about losing money: 43, 12.8%. China, Russia or other foreign states: 116, 12.6%. The 224 (13.8%) saying the minister or politicians don't understand IT are the fifth most common reaction, but they hold 5.7%. Calls for the minister to resign, or for the Digital Agency to go: 232, 4.2%. Now the count against my lady's reading. My lady said the information-poor are probably more than half of Japan, and politicians even more. I have not checked where those figures come from, and this note does not state them as fact. The 40 comments mentioning ordinary people's IT skills hold 3.9% of the agree presses and 14.9% of the disagree presses. My lady also said even people who work in IT are used cheaply. The 10 mentioning IT workers' pay or treatment, or Japan's failure to train them, drew 34 agree presses between them - 0.1%. The 25 saying companies cut security as a cost hold 1.5%. The professor quoted in the story said much the same, but the thread put almost no votes there. The 21 mentioning PHP hold 2.7%; I found none mentioning anyone staying up all night to patch it. My lady said companies hoover up data they don't need: that is where the biggest share of the agree presses went. My lady also said all they do is wave around copy-and-paste privacy terms: the 14 mentioning terms or disclaimers hold 9.6%, and 11 of them were about the state's own terms for the My Number system, not companies'. The 5 attacking hollow apologies, the top comment among them, hold 26.7%. My lady also said this frustrated thread will sit on its hands until the money is gone. The 275 (16.9%) saying what should actually be done hold 19.7%; 80.3% of the agree presses went to comments that did not get that far. The 11 mentioning the three measures the minister actually asked for hold 0.5% of the agree presses and 13.3% of the disagree presses; the 35 that read the advice as change your password often hold 10.9%. Which comment went where was decided by reading each of the 1,625, so please read the figures as approximate. 104 comments (6.4%) contain words looking down on people or blame people by nationality; they hold 1.4% of the agree presses and are not quoted here. The comment my lady shared is 1st by agree presses: 6,233 agree, 239 insightful and 112 disagree presses, with 100 replies.
Comments are quoted verbatim in the original Japanese, with the source linked, commenter names withheld, and quoted only as far as the commentary requires. Translations are mine. Source articles may expire (retrieval dates noted). The substance of this piece is the author's commentary.
