Japan Banks and Airlines Go Offline Due to Software Flaws

On October 22, banks, airlines, and other companies in Japan turned off parts of their websites and apps after a serious flaw was found in a widely used web programming language called PHP. The flaw made it possible for hackers to break into systems that use PHP, so many businesses shut down their online services to stay safe. People in Japan were suddenly unable to open bank accounts online, get digital boarding passes, or visit customer service websites. Governments around the world, including in Japan, the United Kingdom, Australia, and the United States, rushed to figure out how serious the problem was.

Japan's Prime Minister Sanae Takaichi posted on social media platform X, urging all groups that use PHP — including government offices — to install security updates as fast as possible. Leaders in other countries sent the same message to their organizations. Finland even started pulling its government websites offline a day early, on October 21, just to be safe. The Dutch government also took down national and local websites as a precaution.

PHP is one of the most widely used programming languages on the internet. It powers millions of websites, online stores, and other web services. Because so many systems use PHP, one flaw in it can cause problems across a huge number of websites all at once. Experts call this a 'supply chain' problem, meaning that when one popular piece of software has a bug, it can spread to everything that depends on it.

In Japan, some of the country's biggest financial companies were affected. Mizuho Financial Group, one of Japan's largest banks, shut down several of its services and said it was taking emergency steps to improve security. Shizuoka Bank also suspended its website and app. Mitsubishi UFJ Financial Group, another major bank, halted some of its online services as well.

Airlines in Japan were also impacted. All Nippon Airways, which flies under the name ANA, disabled some services, including the ability to get boarding passes through Apple Wallet. The airline said it found no sign that hackers had broken in, but it shut down those services as a safety measure because some of its systems use PHP. Japan Airlines also took down web pages and services, and East Japan Railway and convenience store chain Seven-Eleven Japan took down some of their web services too.

Japan is especially vulnerable to this kind of problem for several reasons. The country relies heavily on old, outdated software that is harder to keep safe. Many companies in Japan also depend on outside technology providers to handle their security, rather than having their own expert teams. In a survey of companies listed on the Tokyo Stock Exchange, 70 percent of those running PHP said they were using old versions that were no longer officially supported or updated.

Japan also has a serious shortage of cybersecurity workers — about 110,000 fewer than it needs, according to the country's Ministry of Economy, Trade and Industry. Most of the cybersecurity experts that do exist work for technology companies, leaving businesses in retail, finance, and transportation without enough in-house help. This forces those companies to hire outside help when problems arise, which can be slower and more complicated. When a security issue happens, the easiest and safest solution for many of these companies is simply to take their customer-facing services offline.

Lisa Landau, the chief executive of Tokyo-based cybersecurity company ThreatLight, said Japan's digital infrastructure has been struggling for years. She warned that the problems keep getting worse, especially as artificial intelligence helps hackers carry out bigger and more targeted attacks. Japanese companies, she said, have not been keeping up with the growing threats they face. She asked a key question: 'Why does routine security maintenance require interrupting the business?' Her concern is that for many Japanese companies, fixing security problems is so disruptive that it becomes a threat to the business itself — and that points to a much deeper problem than any single software flaw.