Japan recorded 233 publicly disclosed security incidents in October 2026, approximately 2.4 times its previous monthly peak, as researchers uncovered AI-assisted exploitation targeting application backends.
MM Research Institute estimated that incidents disclosed during October exposed or potentially exposed 185 million personal information records, nearly four times the total reported throughout 2025.
Thirty incidents involved at least one million records each. These figures represent records rather than unique individuals and combine suspected exposure with confirmed compromises.
Japan Hit by Record Cyberattack
Email distribution provider Arara confirmed attackers obtained approximately 81.3 million email addresses, potentially affecting 380 corporate customers. Depending on the customer, exposed information included names, birth dates, telephone numbers, addresses, and membership details.
Attackers also abused its delivery infrastructure to distribute up to 7.13 million fraudulent messages impersonating credit card companies between October 28 and October 30.
Arara suspended the affected service on October 31; SEGA subsequently disclosed exposure of approximately 2.2 million newsletter addresses.
A separate intrusion into Ymir Link’s Cuenote FC platform exposed approximately 47.9 million email distribution records across 49 systems, according to its November 11 update.
Investigators identified software exploitation, stolen session information, and abuse of legitimate CSV export functionality. Together, these factors show how session hijacking and authorized application features can enable bulk extraction after a compromise.
Socket said downstream customers consequently faced exposure investigations even when their own infrastructure showed no evidence of direct intrusion.
JPCERT/CC’s October 21 investigation identified attackers using AI to scan for known weaknesses and attack APIs. Investigators found that attackers analyzed Android application packages to identify backend endpoints and test flaws, including server-side request forgery.
This attack class can cause servers to issue unauthorized requests to otherwise restricted resources. However, researchers have not established how much AI contributed to Japan’s overall surge, preventing attribution of the record disclosure volume primarily to automated exploitation.
Another attack server contained Blutter and jadx, tools supporting Flutter and Android reverse engineering. Application analysis can reveal authentication mechanisms and API routes not available on public websites.
Separately, Macnica identified 288 web-system intrusions involving potential data theft through October, compared with 84 throughout 2025.
Its dataset excluded ransomware, credential stuffing, and duplicate customer disclosures tied to compromised providers. Membership portals and business or administrative applications represented roughly two-thirds of October cases.
Japan announced a 10 billion yen emergency cybersecurity package covering intelligence gathering, AI-assisted flaw detection, and incident-response support.
Authorities urged organizations to inventory software components, replace unsupported applications, establish remediation priorities and deadlines, and assess contractor-operated systems and APIs.
Meanwhile, TrendAI counted 82 ransomware disclosures from January through September, versus 79 during the same period in 2025, suggesting ransomware alone does not explain the broader increase.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
