Japan's wave of data breaches: what the JPCERT/CC and NICT warnings say, and what leaders should check now

Key points

• 454 data leaks were reported in Japan from January to September 2026, 1.5 times the year before. By mid-October, 19 cases involved confirmed or possible leaks of at least 1 million records, more than in any full year since 2022 (MM Research Institute, as reported by the Asahi Shimbun).^[1]
• On 8 October, JPCERT/CC issued a warning about the run of break-ins. It lists four methods reported to it: scanning for known vulnerabilities, abusing an app's internal management APIs, a vulnerability in the BI tool Metabase, and planting web shells.^[2]
• On 13 October, NICT said it had identified one cause: attackers analysing public smartphone apps to find and attack the servers behind them, which it calls the App-to-Backend (A2B) attack.^[3]
• The government is asking company leaders to take charge of strengthening defences. A first step is knowing what your company exposes to the internet.^[4]

What is happening

Since around September 2026, companies across many industries have been disclosing large personal-data leaks. The Asahi Shimbun reports that disclosures have come almost daily in October.^[1] Some of the main cases are below. Figures are as published at the time and may change in later reports.

1. Announced 28 September 2026

   Times Mobility (Times Car car-sharing)

   Unauthorised access exposed about 6.6 million records of personal information, including driver's licence images. On 16 October the company said it would delete licence images right after checking them at registration, instead of keeping them for seven years after a member leaves. ^[1]

2. Announced 16 October 2026

   Yamato Transport

   The company said a cyberattack first disclosed in September exposed 5.31 million records containing personal information. ^[1]

3. October 2026

   Nikkei Inc.

   Unauthorised access to a cloud service exposed about 1.83 million records. ^[1]

4. October 2026

   Estore Corporation (e-commerce platform)

   The company disclosed a breach involving personal information of about 23.35 million people, about 2.09 million of them with some credit card information. ^[1]

5. Announced 19 October 2026

   H2O Retailing (Hankyu Hanshin Department Stores)

   The company said unauthorised access to a website run by its subsidiary may have exposed personal data in about 1.26 million H2O ID accounts, almost the entire member database. ^[1]

Experts say the attacks are not especially sophisticated. Hiroaki Kuramochi, CTO of Lac Co., said most cases involve known vulnerabilities or configuration errors. Professor Tetsutaro Uehara of Ritsumeikan University said attackers seem to search for weaknesses in applications and web services exposed online and take large amounts of data directly, rather than spending a long time breaking deep into a company's network.^[1]

How attackers are getting in

JPCERT/CC's warning groups the reported methods into four cases. It states clearly that not every incident used the same method.^[2]

1. 01Scanning for known flaws: rather than one product, attackers check each target for many known vulnerabilities and try to exploit them. Some attacks also abuse poor housekeeping, such as stealing configuration or backup files.^[2]
2. 02Abusing APIs: attackers analyse public smartphone apps to find their APIs (the channels an app uses to talk to its server) and keys, then use them to create accounts or change permissions in ways the app's screens never allow.^[2]
3. 03A flaw in a BI tool: an SQL injection vulnerability in the data analysis tool Metabase (CVE-2026-72898) is being exploited.^[2]
4. 04Web shells: malicious files that let attackers run commands from outside were placed on application servers reachable from a public web server.^[2]

On 13 October, NICT's threat analysis team named the app-based method the App-to-Backend (A2B) attack. For the company that publishes the app, it means attackers learn how servers it never meant to show work inside, and aim straight at their weak points. NICT notes the same problem can affect iOS apps and web services, and that AI makes analysing apps and finding flaws faster, so these attacks may spread.^[3]

What the government is asking for

After the Personal Information Protection Commission issued a warning on 7 October, the National Cybersecurity Office asked companies that handle large amounts of personal data, among others, to tighten their defences on 9 October.^[5][4] It says systems exposed to the internet should be defended on the assumption that they could be attacked at any time, and that cyberattack damage is no longer a problem for the IT department alone, urging company leaders to step up.^[4]

The main measures it lists are applying patches quickly, shutting down unused systems and features, introducing multi-factor authentication, managing contractors as well as your own systems, and not keeping data you no longer need.^[4] Experts likewise say that since no company can stop every break-in, holding less data fundamentally reduces the damage.^[1]

What leaders should check now

The technical work belongs to your IT staff or contractors, but leaders can ask the following questions. They are based on the recommendations from JPCERT/CC and the National Cybersecurity Office.^[2][4]

1. 01Do we have a list of every server, admin screen and BI tool we expose to the internet? Have we stopped exposing the ones the business does not need?
2. 02Are patches applied promptly on the systems we expose? Are any products past their end of support still running?
3. 03Do our app and web service APIs check each user's permissions and limit how many requests can be made? If development or operation is outsourced, have we asked the contractor?
4. 04Are we still holding data past its retention period, or data we no longer use?
5. 05If a leak happens, do we know who decides what, and how we will inform customers and the authorities?

Where ZeroKai helps

The first question, what do we expose to the internet, is harder to answer than it sounds. Development servers, old campaign sites and admin screens set up by contractors are easy to miss. ZeroKai takes a domain name, reads what is already public about it, and organises what can be seen from outside.

• It lists host names recorded in Certificate Transparency logs. The names can reveal development servers or admin screens you had forgotten about.
• For domains whose ownership you have verified, it shows services exposed to the internet, based on Shodan's observations.
• It also checks email authentication (SPF and DMARC) and DNS settings. Breaches are often followed by warnings about fake emails pretending to be the victim, so it helps to know how well your domain resists impersonation.
• It never contacts your servers, and every finding comes with its evidence, its source and the time it was seen.