Article Categories

All Articles

Soft Skills

Organizational Culture

Technology

BLOG

What Is Secure by Design? What Japan's 2026 Data Breaches Taught Us About Safe Digital Transformation

October 16, 2026

Technology

What secure by design means
Digital transformation and security go together
What the 2026 incidents have in common
Our standard AWS setup
Run by certified engineers, audited every year
FAQ
Summary

In October 2026, ransomware hit a Japanese cloud provider and stopped the systems of the 495 companies and local governments that used it. One of those customers, a railway company, said about 6.09 million customer accounts may have been affected. The provider later said it had judged that no data left its systems, but its customers could only wait for a system they did not run to come back.

The same pattern runs through this year's incidents. Data is only as safe as the weakest company that touches it, and that weakness is usually created long before the attack, when the system is designed or a vendor is chosen. Adding security at the end of a project does not fix a weak design.

We have built on secure by design since our first client project. This article explains the idea, what the 2026 incidents have in common, and the AWS setup we use as standard.

Written by Manip Poudel, cloud and security engineer at wesionaryTEAM (AWS Certified Security – Specialty).

Security is decided at design time. Bolting it on means a check at the test stage only; secure by design makes safe settings the default from scope to operation.

What secure by design means

Secure by design means building security into a system from the first design instead of testing for it at the end. The safe setting is simply the default.

Take a database. No developer has to remember to keep it private each time. The template creates it private, and it stays that way unless someone deliberately changes the reviewed template.

We build three habits into how we work.

We map the risks with the client. During requirements we agree which data is really needed, who may see it, and what would hurt most if it leaked. Data you never collect cannot leak.
We define infrastructure as code. Every environment is built from the same reviewed templates. Nothing is changed by hand, so safe settings do not drift.
A certified engineer is accountable. The setup is reviewed before launch and kept safe after it.

Digital transformation and security go together

In its 2018 DX Report, Japan's Ministry of Economy, Trade and Industry warned that if ageing systems and the IT skills shortage were left alone, losses of up to about 12 trillion yen a year could follow from 2025. This became known as the "2025 cliff".

Eight years on, large companies have moved ahead, while many smaller ones are only starting. In IPA's DX Trends 2025, 96.1% of companies with 1,001 or more employees had started digital transformation, against 46.8% of those with 100 or fewer. A survey by the Organization for Small & Medium Enterprises and Regional Innovation found that 39.1% of SMEs were working on or considering it, and named the lack of specialists and budget as the main hurdles.

Moving work from paper, phone and spreadsheets to the cloud makes daily work much easier. It also gathers customer information that used to sit in a cabinet or on one PC into a system connected to the internet. The fewer IT staff a company has, the more natural it is to worry about that.

We have co-created systems with clients in industries that had little IT before, such as a ryokan's day-trip bath booking system. What these clients want is not a technical lecture but a setup and a team they can trust. So we start with a small scope, build on a safe setup from day one, and look after access management after launch.

What the 2026 incidents have in common

Japan's Personal Information Protection Commission received 19,417 reports of personal data leaks and similar incidents in fiscal 2025, 17,139 of them from private companies. Large incidents have continued in 2026.

In October, ransomware hit the cloud provider IDC Frontier and stopped systems for 495 companies and local governments. JR East, one of its customers, said about 6.09 million customer accounts may have been affected. The provider later judged that no data had been taken outside.
Also in October, Daiichikosho said information on about 8.72 million customers may have been affected after unauthorised access to a system managed by an outside contractor.
In the same month, Adventure, operator of a travel booking site, reported a possible breach of about 14.64 million sets of personal information after an attack on its servers and booking-site management system.
In June, Aflac Life Insurance disclosed a leak of information on about 4.38 million customers. Reports on its investigation said it lacked a way to monitor and control large volumes of data queries made in a short time.

Three things stand out.

The entry point was a third party. Because a vendor or cloud provider ran the system, the data owner had to rely on them to detect and respond.
Bulk access was not stopped. Without a way to detect and block large, fast data pulls, the damage keeps growing.
Recovery depends on preparation. Without backups and infrastructure that can be rebuilt, an outage drags on.

None of these are easy to find in a test just before launch. Most sit in earlier decisions about design and vendors.

Our standard AWS setup

In our standard setup, the application and business data live in the AWS Tokyo region. Only the entrance faces the internet; the data stays inside a private network.

Only the entrance, WAF and CDN, faces the internet. The load balancer, application and database sit in a private network in the AWS Tokyo region, and GuardDuty and CloudTrail watch the whole account.

Network. The application and database sit in private subnets, and the database accepts no outside connections. Reach narrows step by step from the entrance to the load balancer, the application and the database. Server work does not use an SSH port open to the internet.
Monitoring. AWS WAF stops bad requests at the entrance and caps requests per source to limit bulk scraping. Amazon GuardDuty detects suspicious activity and alerts our engineers, and AWS CloudTrail records who changed what and when.
Encryption. All traffic uses HTTPS, and stored data is encrypted. File storage cannot be read directly from outside.
Sign-in and permissions. Our engineers sign in through single sign-on, with no long-lived access keys. Each workload gets only the permissions it needs, and end users can use multi-factor authentication.
Secrets. AWS Secrets Manager generates the database password; nobody needs to see it. Keys and config files are checked before they can reach the code repository.
Ransomware readiness. Production databases are backed up automatically and protected from deletion. A released application version cannot be overwritten.
Growth. The application and database scale with load, so you can start small and keep the same setup as you grow.

For payment, medical or other sensitive data, we agree extra measures with the client at the design stage, such as managed encryption keys, cross-region backups and multi-factor authentication for every user.

Run by certified engineers, audited every year

A good setup still needs people to run it well. Our cloud team includes an engineer certified in AWS Certified Security – Specialty, which AWS says validates expertise in creating and implementing security solutions in the AWS Cloud.

To a client, we are a third party too. So the AWS account stays in the client's name, and every change is recorded in CloudTrail. We hold ISMS (ISO 27001) certification, and the following work is documented and audited every year.

reviewing the setup before launch and after major changes
managing access and removing it on the day a member leaves the project
keeping secrets in Secrets Manager, never in spreadsheets or chat
reviewing alerts and responding to incidents

FAQ

How is secure by design different from security testing?

Testing looks for problems in a finished system; secure by design makes problems unlikely from the start. We do both, but we start with the design.

Where is our data stored?

The application and business data are in the AWS Tokyo region. The content delivery network that serves pages quickly uses locations outside Japan by design.

Does this slow development down?

No. Each project starts from a reviewed setup, so security does not have to be worked out from scratch, and the first release is often faster.

Can you help with our existing system or AWS account?

Yes. We review the current setup, explain the risks, and agree the steps to improve it with you.

Summary

The 2026 incidents showed what happens when security decisions come late. Weakness is created at the design stage, so the quickest way to protect data is to build security in at that stage too.

If you are planning a new system, ask a project manager about the setup and cost range, security included, through our free estimate consultation. If you are worried about a system you already run, contact us for a review.

Development Consultations and Estimates

As your co-creation partner, we drive business development and DX.

We start with a call with your project manager to confirm what to build and the expected cost range.