Sony confirms critical flaw in IC chips used for Japan's transit cards
August 29, 2025 (Mainichi Japan)

This file photo taken in November 2024 shows the Sony Corp. logo at the company's headquarters in Tokyo. (Kyodo)
This file photo taken in November 2024 shows the Sony Corp. logo at the company's headquarters in Tokyo. (Kyodo)
TOKYO (Kyodo) -- Sony Corp. said Thursday that older versions of its FeliCa contactless IC chips, widely used in Japan for transit cards and electronic money, contain a flaw that could allow attackers to bypass encryption and tamper with stored data.

Certain chips shipped before 2017 are vulnerable, Sony said, acknowledging the issue after inquiries from Kyodo News. Over 1.8 billion FeliCa chips have been produced so far, powering transit cards as well as employee and student identification cards.

A research group in Tokyo discovered the vulnerability and confirmed that encryption keys protecting FeliCa systems could be stolen. It said it reported the flaw in July through Japan's Information-technology Promotion Agency.

Cybersecurity experts warn attackers could alter transit cards, disrupt electronic payments or forge passes for sensitive facilities, with one analyst describing it as an "extremely serious" problem that undermines trust in infrastructure.

Sony said no cases of abuse have yet been detected. The tech giant has yet to announce specific countermeasures, but a fundamental solution is believed to require disabling all older cards affected by the vulnerability.