What BotShade is doing as cyberattacks keep making the news

Lately there has been a steady stream of news about companies and organizations in Japan disclosing damage from cyberattacks. We do not see this as someone else’s problem. BotShade looks after the bots of many people, and the tokens that come with them.

In this article we first lay out what is happening, based on public statistics. We then go over the measures BotShade already has in place and what we will put more effort into from here. At the end, we have a few requests for everyone who uses BotShade.

In this article:

• What is happening
• How we see it
• Measures already in place
• What we will put more effort into
• What we ask of you
• Closing

What is happening

In September 2026, organizations across a wide range of fields in Japan, including transportation, hospitality, retail, education and government, disclosed damage from cyberattacks one after another. Some saw their systems go down and had to limit store operations or reservations. Others had their users’ personal information leak.

The statistics show the same trend. According to figures the National Police Agency of Japan released in September 2026, 123 ransomware incidents were reported in the first half of 2026. That is the highest count for any half-year since the agency began tracking the numbers in the second half of 2020.

Large companies were not the only ones affected. Of the 123 incidents, 79 involved small and medium-sized businesses, more than 60% of the total. Among the 36 incidents where the point of entry was identified, 18 came in through VPN devices and 9 through remote desktop. The attackers went after the entry points that connect to the outside.

Recent incidents have also included cases where a breach at a single service provider or contractor spread to the many companies and users of that service. There have also been reports of secondary damage, where fake messages built from leaked reservation details and similar data were sent to customers.

How we see it

BotShade is a service for building and running Discord bots, and we look after your bot tokens as well as the settings and data your bots use.

That means a problem at BotShade could affect not only your bots but also the Discord servers they run in. The pattern of a breach at one company spreading to its users applies to BotShade too.

We take this responsibility seriously, and we will run BotShade with two things in mind more than ever. The first is to prevent security incidents as far as we possibly can. The second is that, if one does happen, we keep the damage to a minimum and tell you the facts honestly.

Measures already in place

Here is a recap of the measures BotShade already has in place.

Bot tokens and environment variables registered as “secret” are stored encrypted. The encryption keys are kept separately from the database, and once saved, the values are never shown on screen again.

The data used to run your bot is separated per bot by the database itself. The application also filters by bot, so the separation is twofold. Traffic is encrypted with TLS, and API traffic goes through Cloudflare and is protected by Cloudflare.

When our team performs an administrative operation, we record who did what, when, and to what. To protect your account, you can sign in with a passkey and use recovery codes. You can also sign out of all other devices at once.

For details on each of these, see our security page and the article “How we protect your bot token”.

What we will put more effort into

In light of the current situation, these are the efforts we will strengthen further.

We will check vulnerability information for the software and external services BotShade uses every day, and apply fixes as quickly as we can. We will also regularly review who can access our internal accounts and admin tools, and with what permissions, so that only the people who need access have it, and only as much as they need.

For the external services BotShade relies on, we will review what information we entrust to them and how that information is protected. We will also keep to our policy of not collecting information we do not need to provide the service.

If an incident does occur, we will promptly share the facts we know and the scope of the impact in an incident report.

We do not publish the specific details of our defenses or the names of the products we use, because they could give attackers a foothold. We appreciate your understanding.

What we ask of you

Keeping the damage small takes your cooperation as well as our own measures. We ask four things of you.

• Turn on two-factor authentication (2FA) for your Discord account. You sign in to the BotShade dashboard with an account such as Discord, so if that account is taken over, someone can get into BotShade too.
• Register a passkey with BotShade. A passkey is an authentication method bound to your device. Even if you are led to a fake sign-in page, there is no credential for you to type in and have stolen, the way a password can be.

• Do not respond to anyone asking for your token. The BotShade team will never ask you to share your token in a support conversation. A message that claims to be from BotShade and asks for your token or sign-in details was sent by someone other than us.
• If you think your token may have leaked, reset it right away from “Reset Token” in Discord’s Developer Portal. The old token stops working on the spot. Register the new token in the dashboard, and your bot keeps running.

If you receive a suspicious message or notice a security issue, please contact us at help@botshade.com or on our Discord support server.

Closing

No amount of security work can guarantee that damage will never happen. We will keep working both to prevent incidents and to be ready to respond honestly if one occurs.

So that you can keep entrusting your bots to us with confidence, everyone on the BotShade team will keep strengthening our work on security.

Source

• National Police Agency of Japan, “Threats in cyberspace in the first half of 2026” (September 2026, Japanese) https://www.npa.go.jp/publications/statistics/cybersecurity/index.html