Threat intel

On the morning of Friday, October 9, the ruling Liberal Democratic Party's National Cybersecurity Strategy Headquarters met over a run of data breaches at Japanese companies. Its head, former digital minister Masaaki Taira, opened by saying it was fair to call this "an emergency in cyberspace" needing the whole government's effort. The same day, the government's National Cybersecurity Office (NCO), the Ministry of Internal Affairs and Communications, the Ministry of Economy, Trade and Industry (METI), the Information-technology Promotion Agency (IPA) and the Financial Services Agency (FSA) each published an advisory, following ones from the Personal Information Protection Commission on October 7 and JPCERT/CC, Japan's national computer emergency response team, on October 8. On October 6, Digital Minister Toshiharu Furukawa had already asked the public to stop reusing passwords and turn on multi-factor authentication.

English headlines saying "Japan declared a state of emergency" overstate it: Taira chairs a party body, and no legal emergency or new powers followed. What changed is that agencies now spell out what they expect from companies holding personal data and from their contractors. If you have a Japanese subsidiary, run services for Japanese customers, or supply IT to a Japanese company, those expectations reach you.

The breaches behind it

Times Car confirmed that data on about 6.6 million accounts was taken, of which about 1.6 million included identity document images such as driver's licences. Lawson said on October 8 that 2,155,345 Lawson ID records were exposed through unauthorized access in mid-September (reports differ on whether the window ended on September 14 or 17); a manual review found it after automated monitoring missed it. Daiwa Securities said about 110,000 clients' names, email addresses and account numbers may have been stolen from an inquiry management service run by its contractor Scala Communications, accessed overnight from October 2 to 3; its own systems were not breached. And the ransomware attack on IDC Frontier's IDCF Cloud stopped four zones serving 495 customers, which we covered in our post on IDCF Cloud.

English outlets citing the Financial Times count more than 20 major companies. We could not confirm that tally from Japanese sources, and some aggregators recycled older figures.

How the attacks work

JPCERT/CC's advisory (JPCERT-AT-2026-0030) is the only one with technical detail. It calls the information fragmentary and says incidents did not all use one method. It describes four patterns:

• Scanning for known flaws. Each target is scanned for several known vulnerabilities, along with attempts to download configuration and backup files left reachable by mistake.
• Abusing internal APIs. Attackers decompile public smartphone apps to find API endpoints and keys, then call administrative APIs the app's screens never expose: changing user roles, creating accounts, swapping headers or sending malformed tokens to see how responses differ, and using NoSQL injection to extract account data one guess at a time. Some used API keys stolen from other breached systems.
• Metabase SQL injection. CVE-2026-72898 (CVSS 10.0) in the Metabase business intelligence tool lets an unauthenticated attacker inject SQL through the password reset endpoint and take over the admin account, with access to every database Metabase connects to. Exploitation was seen from early August to early September.
• Web shells on application servers. Attackers placed WAR files (Java web application archives) on application servers reachable from a public web server. A JSP page inside runs whatever shell command it receives in a query parameter.

JPCERT/CC notes that BI tools and employee management systems were hit too, systems built on the assumption that only staff reach them. Lawson said the attacker abused the mechanism that shows a user their own details; that sounds like the API pattern, but Lawson has not described the technique.

Taira linked the wave to AI automating attacks, and English reports quote officials saying AI helps foreign attackers past the Japanese-language barrier. No agency advisory attributes these intrusions to AI, and IPA says no single product flaw has been identified as the common cause.

What the advisories ask

The NCO advisory targets businesses holding large volumes of personal or sensitive data and tells them to assume they "could be attacked at any time". On web systems it asks for prompt OS and CMS patching, retiring unsupported products and multi-factor authentication (MFA). On contractors: check their security continuously rather than only at signing, write breach reporting into contracts, and require deletion when the work ends. On data: delete what is no longer needed, encrypt it, never store plain-text passwords, and check public access settings on cloud storage and databases. Victims should share technical details with the NCO and their ministry. The Ministry of Internal Affairs and Communications sent the same content to the firms it regulates, industry groups and local governments, and the Personal Information Protection Commission's October 7 advisory had already asked data holders to patch and delete data they no longer need. METI pushed the message through about 1,000 industry associations, asking top management to fund it.

The FSA asks banks and other financial firms to stop accepting a photo of an identity document in online account opening and to read the document's IC chip instead, now rather than on April 1, 2027, when the law abolishes the photo method. Until then, staff should check every ID image against the applicant's face image for anything unnatural.

What to check if you do business in Japan

1. List every contractor that holds your Japanese customers' data. Inquiry and help desk tools, mail delivery, CMS hosting and analytics are easy to miss; the Daiwa leak came through one. Record what each holds, whether the contract requires breach notice and deletion, and when you last checked.
2. Test the APIs your apps and staff tools call. Every endpoint, undocumented admin ones included, should check authorization per function and accept only the HTTP methods it needs. JPCERT/CC asks for per-API rate limits, tighter on login, password reset, SMS sending and search, and short-lived, least-privilege tokens. Treat keys inside a mobile app as public.
3. Patch or isolate Metabase. Self-hosted instances need the fixed release for their branch from Metabase's August 6 advisory (GHSA-vwf4-m7j8-wcjf). Until then, block /api/session/reset_password at the proxy. Better, put it behind a VPN.
4. Read the logs IPA asks for. Review the last month for internet-facing apps and external services, then widen to three months: rising login failures, sign-ins from odd IP addresses or hours, accounts nobody created, disabled accounts that came back. Look for .war or .jsp files you did not deploy, and search access logs for JPCERT/CC's published IP addresses and user agents, such as Metabase-GHSA-vwf4/2.0. Some IPs may be legitimate, so a match is a lead. IPA says to treat anything odd as an incident and call in an outside investigator.
5. Stop treating an ID photo as proof. If you onboard Japanese customers or staff with a picture of a licence, move to IC chip reading and keep the result, not the image. A caller who knows a licence number and address has proved nothing.
6. Keep backups your cloud provider cannot reach. IDCF Cloud customers in the affected zones were told only their own backups could be relied on. Keep a copy at a second provider under separate credentials and test a restore.

The wider lesson

Several of these leaks came through a supplier's system or a staff-only tool, so the advisories put contractors at the centre: continuous checks, breach clauses, deletion at the end of the work. Expect Japanese partners to ask about exactly those points in their next security questionnaire or contract renewal.

Our attack surface management work finds forgotten internal tools and APIs reachable from the internet, and our web penetration testing tests the authorization checks behind them. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: JPCERT/CC advisory JPCERT-AT-2026-0030, IPA advisory, October 9, ITmedia NEWS on the NCO advisory, INTERNET Watch on the NCO advisory, ITmedia NEWS on the FSA request, Impress Watch on the FSA request, Nikkei on the FSA request, Nikkei on the LDP meeting, Yomiuri via Yahoo News, TBS via Yahoo News, Asahi via Yahoo News, Netshop Tantosha Forum on METI, piyolog summary of the advisories, Digital minister's press conference, October 6, ITmedia NEWS on Lawson, Nikkei xTECH on Lawson, The Japan Times on Daiwa Securities, @IT on Daiwa Securities, The Japan Times on licence data breaches, Tech Times, Silicon Republic.