Behind Japan’s Warnings of a Cyber Crisis

A Significant Increase in Cyberattacks

Throughout Q3 2026, Insikt Group observed a significant increase in reported cyberattacks targeting organizations in Japan. Between Q2 and Q3, reports of such incidents rose 48%, from 621 to 918, according to the Recorded Future Intelligence Platform. Our observations were subsequently validated by statements from Masaaki Taira, head of Japan’s National Cybersecurity Strategy Headquarters (NCSH), declaring a “state of emergency in cyberspace” in Japan following a number of high-profile breaches.

Trend Micro similarly noted an increase in cyberattacks against Japanese organizations, reporting that the number of cyberattacks affecting the country between January and September 2026 exceeded the total for the entirety of 2025, with 86 attacks reported in September alone.

Q3 2026 breach disclosures from Japanese organizations highlight several risks, including operational disruption, exposure of sensitive data, and phishing-enabled account compromise.

The figure below highlights some of the most significant breaches in Japan observed throughout Q3 2026.

Figure 1: Selection of significant breaches in Japan during Q3 2026; the figure is not comprehensive (Source: Recorded Future)

At least two features set the Q3 Japan breaches apart from other such breaches. The first is the breadth of the attacks: victim organizations spanned the retail, rail, logistics, media, education, and software industries, and the intrusions involved ransomware, stolen cloud credentials, and exploited web-facing systems. The second is the scale of the attacks: single incidents now routinely affect millions of user records or organizations downstream that rely on the targeted services, such as roughly 33 million records leaked from the EPARK PeakManager reservation platform in July and 6.6 million accounts from Times Car in September.

This trend has continued into Q4. On October 7, a ransomware incident affected IDCFrontier, a Japanese cloud provider, disrupting 495 companies and local governments. Almost a week later, on October 13, 2026, a data breach affected the Japanese software company Sourcenext. In this incident, an unidentified third party misused the company’s member information retrieval API to compromise 22,519,960 customer records containing personally identifiable information, including email addresses, passwords, names, addresses, phone numbers, dates of birth, employment information, and more.

Our observations complement October 2026 warnings issued by several Japanese agencies, including the Japan Computer Emergency Response Team Coordination Center (JPCERT/CC), the Personal Information Protection Commission (PPC), and the Innovation Platform Agency (IPA), regarding a series of cyberattacks targeting Japan-based organizations. JPCERT/CC’s notice warned of at least four consistent tactics, techniques, and procedures (TTPs) linked to recent incidents:

• Exploitation of known vulnerabilities in unpatched systems or misconfigurations;
• Attacking internal and external APIs, sometimes using stolen API credentials;
• Exploitation of CVE-2026-72898 (CVSS score 10), a SQL injection vulnerability, in the Metabase application;
• The deployment of web shells contained within .war and .jsp files on internet-accessible web servers.

Later reports attributed the cyberattacks targeting Japanese company websites to artificial intelligence (AI) agents linked to activity ranging from basic website scanning to extended attack sequences that involved multiple tools and techniques.

Japan-based Macnica Security also reported a surge in cyberattacks since July 2026 involving personal information leaks from web systems. The company noted that this increase is unique to Japan compared with other countries. According to Macnica, of the 119 cases disclosed in 2026, approximately 68% were announced since July. This accounts for about 31% of the total 265 cases over a 34-month period. The company similarly observed unauthorized access through weak authentication, stolen credentials, or exploited software vulnerabilities and site-specific flaws in application design, APIs, or access controls. Macnica could not confirm the use of AI in these attacks.

Explaining the Increase in Incidents

Multiple factors are likely responsible for the recent increase in attacks affecting Japanese organizations.

• High Demand in the Criminal Ecosystem for Japanese User Data: Criminals on the dark web place a premium on data from Japanese organizations due to Japan’s financial and identification requirements and its status as a wealthy, developed economy.
• Widespread Use of Legacy Systems and Software: According to an April 2026 article by Money Forward, more than 60% of Japanese firms still use legacy systems, end-of-life software, and older operating systems. Such systems no longer receive security updates and official patches from vendors, leaving known flaws exposed to increasingly automated attempts to exploit them.
• Operationalization of AI Tooling: While the specific models abused are not yet confirmed, commercial AI products are widely believed to have been leveraged in the recent spate of attacks against Japanese organizations, both for automating the attack sequence (such as automated vulnerability scanning and exploitation), and for reducing the barrier-to-entry historically attributed to the complexity of the Japanese language (such as through the easier drafting of convincing phishing emails in proper business Japanese). Notably, financial institutions in neighboring South Korea were recently the target of an intrusion campaign leveraging ARTEX, a Chinese open-source AI penetration-testing tool attributed to a group Recorded Future refers to as TAG-217. On October 19, the Japanese cybersecurity company GMO Cybersecurity by Ierae reportedly concluded that ARTEX was used in attacks against roughly 80 Japanese companies, with 8 of those attacks occurring in the 30 days prior to its report.
• New Incident Reporting Requirements: Effective October 1, 2026, Japan’s new Active Cyber Defense (ACD) Law imposes mandatory reporting requirements on designated critical infrastructure operators. This is unlikely to account for the surge in reported incidents due to the law’s implementation date in Q4 2026, but it does imply that we will very likely continue to observe a higher volume of incident disclosures from Japanese organizations going forward, and the impending implementation of the law may have induced some organizations to disclose incidents in Q3 that would otherwise have gone unreported.

Recommendations

Insikt Group recommends that Japanese organizations consider the following:

• Migrate away from and/or update legacy systems. Outdated and unpatched devices or software (including operating systems) provide an attractive, easy vector for threat actors to compromise organizations via previously disclosed vulnerabilities and exploits. AI-enabled scanning and automated exploitation have further increased the risk to these systems. Where possible, replace end-of-life hardware and software.
• Harden internet-facing systems. Secure internet-exposed hardware and services such as virtual private network (VPN) servers, web application firewalls, load balancers, small office/home office routers, IP cameras, and DVRs by patching known vulnerabilities, restricting administrative access, enabling additional logging, and disabling unnecessary services. These devices have been increasingly exploited by cybercriminals and state-sponsored actors alike over the last several years for initial access.
• Strengthen API controls. Verify authorization for every API request, test whether users can access other customers’ records, restrict API key privileges, and limit bulk data retrieval.
• Protect accounts against phishing. Require phishing-resistant multi-factor authentication (MFA) and train staff to be vigilant against increasingly well-crafted Japanese-language phishing messages.
• Limit data exposure and prepare for disruption. Delete unnecessary personal information, restrict data export permissions, test restoration from protected backups, and establish manual alternatives for critical services such as reservations and dispatch.
• Adopt privileged access management (PAM). Limit administrative and super-user accounts, providing elevated rights only on a temporary, just-in-time basis.
• Use Recorded Future Threat Intelligence. Customers can proactively monitor for threat actor mentions of their organization and leaked data on dark web forums, chat rooms, and ransomware leak sites by configuring alerts on the Recorded Future Intelligence Platform, regularly ingesting Insikt Group research, and blocklisting known malicious indicators of compromise (IoCs).

Insikt Group adheres to responsible disclosure procedures in conducting its research.

About Insikt Group^®

Recorded Future’s Insikt Group, the company’s threat research division, comprises analysts and security researchers with deep government, law enforcement, military, and intelligence agency experience. Its mission is to produce intelligence that reduces risk for customers, enables tangible outcomes, and prevents business disruption.