You do not have to live your life suspecting everything.
Cybercrime: Malice in Everyday Life — Part 8
You don’t have to be someone special to be targeted.
Everyday life has unseen points of entry. Drawing on publicly available information, we trace how these threats unfold quietly and how their consequences eventually surface in everyday life.
Tomorrow Still Comes
Over the previous seven installments, we have looked at the ways cybercrime can slip into everyday life.
An email from someone we know. A router that had worked without trouble for years. Phishing woven into the flow of ordinary work. A smartphone remotely controlled after its owner was led to install an app through a social media advertisement. Personal records no one intended to share. Access rights left behind in an account belonging to someone who had already left an organization. And a computer being used for crime without its owner’s knowledge.
None of these incidents required an extraordinary setting.
The people in these stories were not unusually careless, either. They were ordinary people: working, caring for their families, shopping, and making use of the internet in the ways we all do.
Perhaps they made a mistake.
But can we really be sure that we would have acted more carefully?
Not answering calls from unfamiliar numbers. Avoiding suspicious emails. Never reusing passwords. Keeping software up to date. Not installing apps from unfamiliar sources.
All of these precautions matter.
But none of us can make the right decision every time, throughout every day of our lives and work.
Sometimes we are busy. Sometimes we are tired. And new methods of attack can emerge before we even know they exist.
What criminals exploit is not limited to human inattention. They also take advantage of legitimate services, useful devices, trust between businesses, and the very systems we rely on every day.
Our goal should not be to live by suspecting everything around us.
The Threats Were Never Far Away
In its Information Security 10 Major Threats 2026 report, Japan’s Information-technology Promotion Agency (IPA) lists ransomware attacks, attacks targeting supply chains and business partners, cyber risks associated with the use of AI, and attacks exploiting system vulnerabilities among the threats facing organizations.
For individuals, the report also covers unauthorized account access, fraudulent use of online banking, phishing, and theft of personal information.
This is more than a ranking. The threats are selected through a review process involving experts, based on incidents with significant social impact that actually occurred during the preceding year.
The list includes issues that affect individuals and small businesses, regardless of the size or public profile of an organization.
For example, using email means having an account that may be targeted. A social media ad promising reward points or exclusive content may lead someone to install an app that gives an attacker remote control of their smartphone. Selling products online means having customer information and a storefront that need protection. Even a Wi-Fi router at home is a device whose security matters.
Using the internet means connecting with other people and services.
Those connections also create opportunities for attackers to exploit.
That does not mean we need to go back to a life without the internet.
What matters is not giving up convenience, but finding ways to keep using it with greater confidence.
Build Protection into the System, Not Just Your Resolve
So what can we do?
Do we need to buy expensive security products, hire specialists, and monitor our networks around the clock?
Depending on the size of a business and the information it handles, more specialized measures may certainly be necessary.
But not everyone, and not every business, needs to start with advanced security measures.
A good place to begin is by building safeguards that do not depend entirely on people always remembering to be careful.
1. Put safeguards around the points of entry
Episodes 1 and 3 explored how email accounts and authenticated sessions can be taken over.
Episode 6 showed how an account that remains active after it is no longer needed can leave an unnecessary way into an organization.
At the heart of these incidents is the access and authority attached to an account.
Passwords alone have their limits. Use multi-factor authentication (MFA) wherever it is available.
Where a service supports them, consider using passkeys as well. Passkeys are a form of authentication that is resistant to phishing attacks that try to trick people into entering passwords on fake login pages.
Give priority to accounts such as:
- Email accounts
- Online banking and payment services
- Cloud storage
- Administrator accounts for social media and online stores
- Administrator accounts used for your business
Use a different password for every service. A password manager can help, so you do not have to remember them all yourself.
Login screens are not the only points of entry. Check where apps come from, and do not casually grant permissions that do not make sense for what an app is supposed to do.
Of course, MFA and passkeys, together with careful checks of app sources and permissions, cannot prevent every kind of attack. They can, however, reduce the chances of an account or device being used without your knowledge.
2. Make updates and backups part of the system
In Episode 2, we saw how a router that had worked without problems for years was quietly turned into a communications relay for criminals.
Episode 5 showed how information, once leaked, cannot simply be taken back.
Losing data—or losing access to it—can affect not only an individual’s life but also a business’s ability to keep operating.
Start by making updates to operating systems, applications, and network devices part of a regular process, rather than something left to chance.
Enable automatic updates wherever possible. When a device is no longer supported by its manufacturer, consider replacing it rather than continuing to use it without security updates.
Backups are just as important.
But simply making backups is not enough.
Ransomware and other incidents can affect both the systems in daily use and the backups at the same time.
Keep the following points in mind:
- Decide which data needs to be backed up.
- Decide how often backups should be made.
- Keep multiple generations of backups so you can return to an earlier state.
- Where practical, store copies somewhere physically or logically separated from the systems in daily use.
- Check that the data can actually be restored.
The purpose of a backup is not simply to preserve data.
It is to make it possible to resume work and everyday life when something goes wrong.
3. Keep track of who can access what
In Episode 6, information was exposed because an account belonging to a former staff member had remained active.
This is an area where a few straightforward processes can make a real difference.
For example, keep a list of who can access which services.
When someone leaves or a contract ends, remove their account and access rights. When someone’s role changes, review and remove permissions that are no longer needed.
Do not overlook sharing settings in cloud services or connections to external apps, either.
The point is not to give trusted people unrestricted access. It is to give them access to what they need for the work they are doing—and no more.
This is not a system for treating people with suspicion.
It is a way to keep misunderstandings and accidental actions from turning into problems that cannot easily be undone.
Start with What You Can
By this point, you may be thinking: “There is so much I am supposed to check.”
But you do not need to do everything at once.
In March 2026, the IPA published the 4th edition of its Guidelines for Information Security Measures for Small and Medium-Sized Enterprises. Related explanatory materials were updated in September 2026.
The guidelines are intended to cover sole proprietors and small businesses as well, and are structured to help them improve their security step by step.
The first step is a set of six basic information security practices:
| Basic practice | What you can do in everyday work |
|---|---|
| Keep operating systems and software up to date | Enable automatic updates |
| Use antivirus software | Keep its protection features enabled |
| Strengthen passwords | Use long, complex passwords and never reuse them |
| Review sharing settings | Stop unnecessary public access and sharing |
| Back up data | Back up regularly and check that you can restore it |
| Learn about threats and attack methods | Follow security advisories from public organizations |
These six practices are basic steps that can be started without specialized expertise or a major investment.
The IPA also provides checklists for reviewing an organization’s security measures, sample information security policies, and guidance on responding to incidents.
There is no need to aim for perfection from the start.
Begin by understanding your own environment: what is already in place, and what still needs attention. Even that is a step forward from continuing to use systems without knowing where things stand.
Be Ready for the Day Something Happens
No matter how many precautions we take, it is impossible to prevent every incident.
That is why it is worth deciding in advance what to do if something does happen.
For example: you receive a login notification you do not recognize. You discover that a suspicious email has been sent from a company account. You realize that you have installed an unfamiliar app on your smartphone. Or an unexpected warning appears on your computer.
In those moments, there is no need to rush into deleting everything or to keep using the device without understanding what is happening.
Depending on the situation, isolate the affected device or its network connection, preserve records such as logs and screenshots, and contact the service provider, a specialist, or an appropriate public support service.
Having contact details and response steps ready in advance can make it easier to stay calm when the time comes.
For a small business, even a simple list of whom to contact and which service providers to call can help.
Security is not only about keeping intruders out.
It is also about limiting the damage and returning to everyday life as soon as possible.
Beyond the Darkness
We have seen a number of unsettling events throughout this series.
They did not take place in some distant world where only extraordinary criminals operate. They unfolded in the everyday lives of ordinary people.
Checking work email. Shopping. Staying in touch with family. Asking someone for help. Thanking someone whose work has come to an end.
Malice can find its way into actions as ordinary as these.
But that does not mean we have to give up our everyday lives.
We do not need to suspect every email, distrust every person, or keep up with every new attack technique.
People make mistakes.
Devices grow old. Software vulnerabilities are discovered. Service settings change. People start jobs, and people leave them.
We can gradually put safeguards in place with those changes in mind.
No method can promise 100% security.
Even so, we can make our lives safer than they would be without any precautions. We can lower the likelihood of becoming victims, and reduce the damage if something does happen.
Cybersecurity is not about living in fear.
It is about protecting the lives we live.
So that a small business can open its doors and carry on tomorrow.
So that individuals can shop, talk, and connect with peace of mind.
So that people can use the services they depend on with confidence.
And so that all of us can enjoy the convenience of a digital society without carrying more anxiety than we need to.
Beyond the darkness is not a world where every threat has disappeared.
It is a world where we understand that threats exist, have taken sensible precautions, and can continue with our everyday lives in peace.
What we need to protect is not the computer, the data, or the system itself. It is the everyday life that exists beyond them.
References
-
Information-technology Promotion Agency, Japan (IPA), Information Security 10 Major Threats 2026 (published January 29, 2026). https://www.ipa.go.jp/security/10threats/10threats2026.html
-
Information-technology Promotion Agency, Japan (IPA), Guidelines for Information Security Measures for Small and Medium-Sized Enterprises, 4th Edition (published March 27, 2026). https://www.ipa.go.jp/security/guide/sme/about.html
-
Information-technology Promotion Agency, Japan (IPA), What to Do When Your Personal Information Is Leaked: Response and Everyday Precautions (October 2026). https://www.ipa.go.jp/security/anshin/attention/2026/mgdayori20261026.html
-
Information-technology Promotion Agency, Japan (IPA), Lessons from Ransomware Incidents: A Ransomware Preparedness Handbook for Business Leaders (published September 8, 2026). https://www.ipa.go.jp/security/todokede/crack-virus/ransomware_lessons_learned.html
The references above are publications by Japan’s Information-technology Promotion Agency (IPA), an independent administrative agency in Japan. The English titles are translations of the original Japanese titles. This article draws on the series as a whole and on information published by public organizations including the IPA, bringing together basic measures that individuals and small businesses can put into practice.