A vulnerability discovered in PHP, a programming language widely used in website development, prompted financial institutions and municipalities across Hokkaido to suspend web services in rapid succession from the evening of the 21st through the 22nd. No damage has been confirmed, but each organization has taken precautionary action prioritizing safety.
Sapporo City stopped public access to its official website from 9 p.m. on the 21st. The city said no unauthorized access or tampering has been confirmed and explained that it shut the site as a precautionary measure. The timing of restoration is not yet known, and the city will disseminate emergency information such as disaster alerts through its official X (formerly Twitter) account. It has also set up a simplified site listing contact information for ward offices within the city and said it will announce further details on official social media as soon as they are known.
The impact on financial institutions is broad. North Pacific Bank suspended its website from around 2:30 a.m. on the 22nd until noon. Some web services, including new applications for card loans, remain down for maintenance. Five group companies have taken similar measures. Hokkaido Bank has suspended its “Dogin App,” which lets smartphone users check balances and transaction records, since 7:30 p.m. on the 21st, and some web services such as applications to open ordinary savings accounts remain unavailable. The bank plans to announce the resumption date on its website and elsewhere. Both banks said they have received no inquiries from customers.
The fallout also spread to retail and transportation. Satudora Holdings, which operates drugstores, temporarily suspended its website around 10:45 a.m. on the 22nd. According to a public relations representative, the company closed the site abruptly after being contacted by its website management company, which is being flooded with inquiries from other companies as well. The company said its e-commerce site remains fully operational.
Major airline AIRDO (Sapporo City) stopped issuing boarding passes through the Apple Wallet feature. It is asking passengers to use two-dimensional code boarding passes sent by email or to obtain passes at airport self-service check-in kiosks.
Municipal responses extend beyond Sapporo City. Kitahiroshima City temporarily suspended its official LINE app. Chitose City has halted the “email to the mayor” and “inquiry forms for each department” features on its official website, as well as its easy-Japanese service. Ishikari City has also suspended three services, including inquiry forms for each department on its official website, with some expected to be restored around the 26th.
PHP has long been adopted for building websites for companies and government agencies around the world as a language suited to generating dynamic web pages. The latest vulnerability has a wide reach, and the decision to temporarily halt site operations cascaded across Hokkaido.
OrganizationSuspended serviceStart of suspensionSapporo CityOfficial website9 p.m., 21stNorth Pacific BankWebsite, some web servicesAround 2:30 a.m., 22ndHokkaido BankDogin App, some web services7:30 p.m., 21stSatudora HoldingsWebsite (temporary suspension)Around 10:45 a.m., 22ndAIRDOApple Wallet boarding pass issuanceNot disclosedKitahiroshima CityOfficial LINE appNot disclosedChitose CityEmail to the mayor, inquiry forms, etc.Not disclosedIshikari CityInquiry forms and two other servicesNot disclosed
Note: Based on disclosures by each company and municipality. Items without an explicit suspension time are listed as not disclosed.
For financial institutions, suspending online banking and apps directly means a temporary loss of customer touchpoints. In this case, all measures were precautionary steps taken before any damage was confirmed, and a large-scale customer exodus after restoration appears unlikely. Still, the episode puts a spotlight on how quickly institutions respond in the initial phase of an incident and how carefully they communicate. For municipalities, some inquiry counters for residents are unavailable, requiring them to strengthen responses by phone and in person. Companies whose systems use PHP need to urgently check the status of patch applications and secure alternative measures in case they are forced to suspend operations.
AloJapan.com