The door was the VPN

Of the Japanese ransomware victims that could say how the attacker got in, two thirds were entered through their VPN appliance. The door they installed so staff could work from outside became the way in.

Summary

In 2025, 61 of the 92 Japanese ransomware victims that could say how the attacker got in named their VPN appliance (66.3%). Email accounted for two.
A VPN appliance is a door in the outer wall that lets staff in without passing reception. Anyone on the internet can walk up to it.
Most flaws in the appliance can be used before login, so the password and multi-factor authentication (MFA) may never be checked.
Once inside, intruders take the master keys (Active Directory), delete the backups, copy data out and encrypt last. In 2025, 79 of 99 victims that tried to restore from backup could not.

VPN appliance61 of the 92 cases with a known route in 2025 (latest full-year figures, published March 2026)First half of 2026 (published September 2026): 18 of 36 answers (50.0%)

Fig. 0-1Minato Precision head office, points of entry. One square per case (2025, the 92 cases with a known route)Composite scenario, fictional companyNTS (not to scale)

Source: National Police Agency 「令和７年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編P122, P124, P126, P129, P130; sheets 統計編P137, P138)

Data

Route	Cases	%
VPN appliance	61	66.3
Remote desktop	19	20.7
Other	10	10.9
Suspicious email or attachments	2	2.2
Total	92	100

2026 H1 is a half-year with 36 answers and no email row.

Fig. 0-2VPN appliances as a share of known entry points, by year

Source: National Police Agency 「令和８年上半期におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編p139, p143, p148, p153)National Police Agency 「令和４年におけるサイバー空間をめぐる脅威の情勢等について」 (p.5 図表6)National Police Agency 「令和５年におけるサイバー空間をめぐる脅威の情勢等について」 (pp.25–26 図表25)National Police Agency 「令和６年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheet 資料編P46(3))National Police Agency 「令和７年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編P122, P124, P126, P129, P130; sheets 統計編P137, P138)

Data

Year	VPN	Answers	%
2021	41	76	53.9
2022	63	102	61.8
2023	73	115	63.5
2024	55	100	55.0
2025	61	92	66.3
2026 H1	18	36	50.0

Revisions to this page

Rev. 52026-10-27Text cut to the facts on every page (no announcements, figure-building notes or advice outside the what-to-do page); page titles name what each page answers; the report number and per-section scale tags removed.
Rev. 32026-10-26Corrections after a full read against the sources: Kantsu reclassified to its own wording 'connection point with external networks' (9 VPN, 5 undisclosed, 1 other); case facts, hedges and attributions fixed across chapters 1 to 4 and 6; Ryomo now cites its own third report.
Rev. 22026-10-26Home summary scoped to cases with a known entry route; Nagoya port reclassified as 'device type not disclosed' per the association's own wording; one source entry per document; source titles and dates checked against the documents.
Rev. 12026-10-25First publication

Summary

Point-of-entry plan