A wave of data leaks from Japanese web systems in autumn 2026 has sharpened concern over AI's role in cyberattacks on Japan. The National Cybersecurity Office alerted businesses on October 9, and the chair of the ruling party's cybersecurity headquarters said cyberspace was in a "state of emergency."Researchers reconstructed three attack infrastructures from files left in attackers' open directories. All three are separate from those in earlier reports on ARTEX, an autonomous AI penetration-testing system. AI's role varied widely. Without victim-side logs, the findings cannot confirm each attempt's success, the full damage, or the attackers' identities. Victims are described only by count, industry, size, and country.
Case A: Automated Cyberattacks on Japan
In a short burst in October 2026, Case A abused CyberStrikeAI, an open-source agent-based penetration-testing tool with a Simplified Chinese console. Entries like "credential-search agent 8/44" show 44 agents dividing up reconnaissance, exploitation, command and control, persistence, exfiltration, and reporting. The platform produced Japanese forms and fake login pages. It also throttled traffic to each target to avoid detection. At least 19 organizations received identical reports, including at least 16 in Japan and others in Taiwan and Hong Kong. Most were smaller businesses and local public bodies. Yet many entries read "no session, no web shell, no exfiltration." The deepest intrusion began at an unauthenticated administration interface on a legacy system.
Case B: Human-Led, AI-Assisted
Over about 24 days in August and September, a human operator used an LLM for planning and tooling. The operator scanned at least 6,000 Japanese IP addresses and also probed AI assets in South Korea. One LLM-written plan targeted AI and GPU services. To get it, the operator framed the request as an authorized assessment to bypass the model's guardrails. Other tools sought to hijack and pool access to other people's AI services, likely to get cheap inference capacity.One company suffered full control through FTP, a database, administrator rights, a web shell, and SSH, and the attacker repeatedly restored backdoors after cleanup. At another, a GIS server left on default credentials exposed several hundred thousand cadastral and commercial records, Windows credentials, and email. Several hundred attempts on one cluster failed.
Case C: Limited AI Role
From January to October, a seasoned operator ran at least six campaigns, several in parallel from September onward. They targeted at least 1,300 WebLogic candidates and 35 VPN entry points, mainly in Japan and South Korea. The target lists also included the UK, France, Italy, Qatar, and Colombia. Devices included Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, and Yamaha RTX1210. On the RTX1210, leftover credentials in configuration files opened direct access to corporate networks. Section headings such as echo '=== ... ===' in the command history and emoji status markers in scripts point, with high confidence, to AI-written tools. A skilled human mimicking that style cannot be excluded.
Lessons Beyond ARTEX
All three operations worked in Simplified Chinese and sorted results under names like jp_success, jp_attack, and jp_cve_attack. Each picked targets opportunistically, and most of their activity came before the ARTEX reports. Whether they share an operator is unconfirmed, and their language is only a weak clue to origin.AI increased scale, speed, localization, and reporting. It did not change the types of vulnerabilities exploited, the entry points, or how many targets were deeply compromised. The AI also logged planned steps as finished and overstated success. LLMs can also invent vulnerability IDs. These flaws can help with detection and honeypots. Defenders found the PHP2Shell flaws, disclosed in October 2026, through an AI-assisted audit, but no AI-found zero-day was exploited in these cases.
Defending Against Cyberattacks on Japan
Recommended steps:
Inventory public-facing systems and update or isolate legacy ones.
Remove exposed default credentials and admin interfaces.
Secure VPN and edge-device configurations against credential reuse.
Check internal AI and GPU services for exposure.
Monitor for low-frequency, distributed attempts.
Prepare for LLM misuse through requests built on false premises.
Fast patching and virtual patching matter more as the time between disclosure and exploitation shrinks. The attackers' identities, the AI models used, and the full damage remain unknown.
Security Blind Spots Identified by AI The large-scale data breaches disclosed in quick succession in South Korea and Japan in October 2026 mostly originated not from internal core systems, but from peripheral entry points such as externally exposed web services, app backend APIs, and outsourced SaaS (services provided by third-party vendors via the cloud, such […]
Three Japan-focused cyberattacks show how AI helps hackers scale operations, while exploiting old systems and weak security remains key.
In autumn 2026, Japanese companies and other organizations reported a series of data leaks involving their web systems. On October 9, Japan’s National Cybersecurity Office issued a warning to businesses, while the head of the ruling party’s cybersecurity team described cyberspace as being in a “state of emergency.”
Researchers at Trend Micro studied three attack infrastructures to understand how hackers use AI. Their findings show three different approaches, ranging from limited AI assistance to systems that use AI agents to manage almost an entire attack.
The researchers looked at files that attackers left on servers anyone could reach. These included attack scripts, lists of targets, logs, and records of commands. The files showed attacks on organizations in Japan and other countries.
But the researchers could not see the victims’ own logs or network records. So they could not confirm every break-in, measure the full damage, or say who was behind it.
Attackers also like to claim more success than they really had. The researchers only counted a result as real when the evidence backed it up.
The three cases show that AI does not play the same role in every cyberattack.
“The cases differ along two dimensions: how much of the attack AI handled and how confidently we can establish its involvement.” reads the report. “Case A used AI to drive the entire workflow, which we confirmed. Case B was human-led, with confirmed AI assistance in planning and tool development. Case C showed high-confidence indications of AI use in a limited role, such as tool development. All three were active in 2026, and much of the activity preceded the previously published ARTEX reports.”
Case A: AI agents managed the attack workflow. The researchers confirmed the use of CyberStrikeAI, an open-source penetration-testing platform built around AI agents. It handled reconnaissance, vulnerability checks, exploitation, data theft and reporting as part of a repeatable process.
The platform split tasks among multiple AI agents. One record mentioned a credential-search agent in a system that used 44 agents. The platform could also generate Japanese content, including forms and fake login pages.
Researchers identified at least 19 target organizations, including at least 16 in Japan. The system worked on several targets at once and kept traffic to each organization relatively low. This made the activity harder to detect by checking the logs of a single victim.
Despite this automation, the platform rarely gained deep access to target systems. In many cases, it had no active session or web shell and showed no evidence of stolen data. The clearest intrusion started through an administration page that was publicly accessible on an old web system. The attackers did not need to exploit a newly discovered vulnerability.
Case B: A human attacker used AI to plan and build tools. In this case, the operator made the main decisions but used a large language model to speed up planning and tool development. The researchers found an attack plan written by an LLM that targeted services providing AI and GPU resources.
The attacker presented requests as authorized security testing to get around the model’s safety limits. The researchers say this was a false claim, although they did not publish the exact method.
The attacker also targeted AI infrastructure, including platforms for AI workflows, data processing and model inference. The researchers believe the goal may have been to gain access to computing resources that could be used to run AI models cheaply.
Some intrusions had serious consequences. In one case, the attacker gained control across several systems, including an FTP service, a database, an administrator account, a web shell and SSH access. The attacker also restored backdoors after they had been removed.
In another case, a geographic information system server was exposed with default credentials. This provided access to hundreds of thousands of land and business records, as well as Windows credentials and email data. The evidence confirmed that information was downloaded.
However, the researchers found no evidence that AI carried out these attacks independently. It helped the operator plan and build tools, while the actual work relied mainly on scripts, existing software and human decisions.
Case C: AI played a limited role. Here, the operator appears to have used AI mainly to develop tools and scripts. The researchers found no evidence that it was involved in planning or managing the wider operation. They rated AI involvement as highly likely, but not confirmed, because they found no direct evidence such as prompts or API keys.
The operator ran at least six campaigns in 2026, targeting exposed VPN devices and Oracle WebLogic servers. The targets included devices from Cisco, Citrix, F5 and Yamaha.
In attacks against Yamaha RTX1210 routers, the operator did not exploit a product vulnerability. Instead, the attacker used credentials found in configuration files. These credentials provided direct access to internal corporate networks.
The researchers also found signs that AI may have helped write some commands and scripts. These included unusually structured comments and emoji used as status markers. Such clues can support an assessment, but they cannot prove AI use on their own.
Japan was the main target in all three operations, but attackers also targeted other countries and regions. All three used Simplified Chinese, but this does not prove they came from the same group or location.
“Simplified Chinese was the working language in all three infrastructures. Japan was the largest target country, although the operators also pursued nearby countries and regions. Entry points were exposed legacy systems or weaknesses left in default configurations.” concludes the report. “Target selection was opportunistic across industries: the operators sought systems that were easy to attack from outside and acted on what they found.”
The main difference was how AI was used. In one case, AI agents managed much of the attack and worked on many targets at once. In another, AI helped a human plan attacks and build tools. In the third, AI was mainly used to develop tools.
AI helped make attacks faster and easier to scale, but attackers still exploited familiar weaknesses, such as outdated web systems, exposed admin pages, default passwords and poorly secured network devices. Researchers also found that AI tools sometimes reported planned actions as successful, making it essential to verify their results.
AI can also help defenders discover vulnerabilities. However, researchers found no evidence that these three operations used AI-discovered zero-day flaws. Their attacks relied on known vulnerabilities and poor security settings.
The report identifies six main priorities for defenders:
Review public-facing systems. Identify old web applications and update them or isolate them if they cannot be secured.
Protect administration pages. Check that management interfaces are not exposed to the internet without a clear need and strong access controls.
Secure VPNs and network devices. Review configurations, remove default credentials and check for reused passwords.
Protect internal AI services. Include AI workflows, inference services and GPU systems in asset inventories, and check whether they are exposed.
Improve monitoring. Look for low-volume attacks spread across many targets, which may be difficult to spot in the logs of a single organization.
Prepare for AI misuse. Organizations that use LLMs for work should train staff to recognize requests that falsely claim to be authorized security testing.
These security weaknesses existed long before AI became widely available. AI simply helps attackers find and exploit them faster and across more systems.
The time between discovering a vulnerability and using it in an attack may also become shorter. Organizations should install security updates quickly and apply temporary protections when patches are not available.
Researchers still don’t know who was behind the three operations, whether they were connected or how much damage they caused. Further reports may provide more answers.
“The attackers’ identities, whether the three cases share an operator, the full scale of the damage, and the AI models used remain unresolved. Our observations come from attacker-side files and still require confirmation from the affected organizations.” concludes the report. “We are considering further technical reporting on individual cases: AI-driven activity in Case A, AI assistance in Case B, and limited AI assistance in Case C. We will also continue working with the relevant organizations.”
The main lesson is clear: AI can make cyberattacks faster and larger, but the basic security priorities remain the same. Organizations must identify systems exposed to the internet, strengthen access controls and detect suspicious activity before attackers turn a simple weakness into a serious breach.
Japan is preparing to set up a dedicated team to run AI-driven cyberattack simulations to expose weaknesses in technology systems. Japan’s plan for AI cyberattack simulations comes as organizations worldwide scramble to address critical PHP flaws that have disrupted parts of the internet.
Speaking on Friday, Industry Minister Ryosei Akazawa said those defending against cyber threats need to think like attackers, using AI proactively to uncover potential weak points before they can be exploited.
His comments follow widespread disruption caused by the disclosure of the PHP flaws, which led to millions of reported hacking attempts. Businesses and governments were forced to patch their systems or temporarily take websites offline.
Because PHP is widely used to build and run websites and web applications, any weakness in the language poses a risk to organizations across many sectors.
How PHP Flaws Hit Banks, Airlines and Government
The vulnerabilities triggered precautionary shutdowns across banking, transport, airline and government services in several countries.
In Japan, Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway temporarily halted some online services. The Ministry of Finance, the National Tax Agency and the Meteorological Agency also suspended certain digital services as part of their security response.
On Friday, JR East said some of its services were back online, while others would resume only after safety checks. Nippon Paint said it had applied a security patch and restored its website.
The disruption shows how difficult it is to secure interconnected digital infrastructure when a widely used software component turns out to have serious weaknesses.
SoftBank Pauses Emergency Alerts Over PHP Flaws
The fallout also reached services people rely on in a crisis. Telecommunications company SoftBank said it was temporarily suspending its mobile emergency alert system while it carried out maintenance to fix a PHP vulnerability.
While the system is down, customers will not receive early warnings through it for earthquakes, tsunami threats, disasters, or evacuation information. The case shows that cybersecurity incidents can extend well beyond ordinary websites and interrupt access to vital public safety information.
Why Japan AI Cyberattack Simulations Point to Proactive Defense
The episode has put a fresh focus on finding vulnerabilities before attackers do. The Japan AI cyberattack simulations are designed to help defenders understand how weaknesses might be targeted and to sharpen their response capabilities, in line with the approach Ryosei Akazawa outlined.
Simulation alone is not enough, however. Installing patches remains essential, and organizations need to test updated systems carefully before bringing services back, especially where transport, finance, and government operations are affected.
As AI tools grow more capable for both attackers and defenders, businesses and governments face the task of pairing fast vulnerability detection with effective security updates, continuous monitoring, and resilient digital infrastructure.
Verify you are human
Checking your browser before accessing this site.
Click to verify →
Then you will be redirected to the requested content. Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare
site-verification-ok
Verify you are human
Checking your browser before accessing this site.
Click to verify →
Then you will be redirected to the requested content. Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare
Purpose and Scope This report summarizes the quantity of new ransomware samples collected, the number of compromised systems, and statistics on targeted businesses during the month of September 2026, as well as major Korean & global ransomware issues. The analysis is based on data collected through ATIP (AhnLab Threat Intelligence Platform) and AhnLab Smart Defense, […]
ASEC Blog publishes Ransom & Dark Web Issues Week 4, October 2026 The Seven Deadly Sins Claims Data Leaks from Seven Organizations Worldwide HYFLOCK Ransomware Attack on a Saudi ERP Software Company Qilin Ransomware Attack on a Japanese Investment Management Company
Japanese police arrested a Chinese couple accused of hiding a computer in a Kobe hotel to send phishing emails and using stolen credit card details for purchases.
Burger King Japan disclosed a breach exposing 11.18 million app users’ personal data after attackers accessed its membership system in early October.
Burger King Japan has disclosed a data breach that exposed the personal information of approximately 11.18 million official app members. Burger King Japan, the company operating the fast-food chain in the country, said attackers accessed the system managing customer membership information between October 2 and October 7, 2026. The company disclosed the incident on October 15, after discovering the data leak two days earlier.
In its official notice published on October 15, the company confirmed the unauthorized access and apologized to affected customers. The announcement doesn’t identify the attackers or explain how they gained access. BK Japan says it’s working with external security specialists to determine the cause.
“We have confirmed that customer membership information from the official app has been leaked externally following unauthorized access by a third party.” reads the data breach notification.
The compromised data includes membership IDs, email addresses, names in Japanese characters and kana, phone numbers, dates of birth, gender, prefecture of residence, and membership registration type. The exposed information also indicates whether a customer has a mobile ordering history and whether their email address has been verified.
These details can be useful to criminals even without payment data or passwords. Attackers can use them to craft convincing phishing emails, text messages, or phone calls that refer to a customer’s real identity and relationship with Burger King. A message that includes a person’s name, phone number, and other accurate details may look far more credible than a generic scam.
Burger King Japan confirmed it does not store credit card numbers and found no evidence that passwords were exposed, with no confirmed cases of fraud so far. However, these factors do not completely rule out the risk of future misuse.
According to the company, unauthorized access took place from October 2 through October 7, and the leak was confirmed on October 13. BK Japan says it blocked access from the source of the unauthorized communications as soon as it became aware of the incident.
The company has also introduced temporary countermeasures, established an incident response team, and reported the breach to Japan’s Personal Information Protection Commission. It says permanent security improvements, further investigation with external specialists, and email notifications to affected customers are ongoing.
“At present, we have confirmed that the unauthorized access was carried out by a third party.” continues the notification.
The company has not yet disclosed the precise circumstances that made the intrusion possible, and the investigation is continuing. Until more details emerge, it’s too early to draw conclusions about the initial access vector or attribute the attack to a particular threat actor.
Large-scale data breaches create long-lasting risks for follow-on attacks, as criminals can use stolen details for phishing, impersonation, and highly convincing scams.
BK Japan urges customers to stay vigilant against fraudulent emails, texts, and calls, warning them never to click unverified links or share sensitive credentials.
The core danger is that attackers no longer need network access to cause harm; they can leverage existing stolen data to target customers directly through social engineering.
“Please do not access URLs, open attachments, or enter membership information or passwords if you receive a suspicious communication.” concludes the report.
Note The September 2026 Dark Web Breach Incident Trend Report focuses on data breach cases and the sale of initial access credentials posted on the deep web and dark web forums. The report explicitly states that the accuracy of some of its content cannot be fully verified due to the nature of the sources. Major […]
Note The September 2026 Dark Web Threat Actor Trend Report focuses on threat actors active on the deep web and dark web, as well as publicly reported cyberattack incidents. It is noted that the factual accuracy of some content cannot be independently verified. Major Issues Some hacktivist groups claimed responsibility for DDoS attacks targeting the […]
This weekly roundup covers a massive exposure of personal data from Denmark's national population register, a U.S. bounty on a Chinese hacker accused of stealing COVID-19 research, Japan's plan to actively search for attackers hiding in its critical infrastructure, a pair of breaches at Japanese publisher Nikkei, a call for AI-driven decision-making in security operations, and a Massachusetts town's ongoing recovery from an August cyberattack.Two threads run through this week's stories. First, attackers keep getting in through doors that were already open: a company's lawful access to a government register, employees' hijacked email accounts, and unpatched mail servers. Second, the time between intrusion and discovery remains dangerously long, which is why governments and security leaders are pushing to find intruders sooner and respond faster.
The Cyber Express Weekly Roundup
Hackers Abuse Company's Legitimate Access to Expose Data of 8.8 Million in Denmark
The Danish government said unauthorized individuals obtained the names, addresses, and CPR numbers of roughly 8.8 million people from the Central Person Register. They did it by misusing the legal access granted to a private Danish company. The register holds records on about 11 million people, including residents, Danes living abroad, and deceased individuals. Read more…
US Offers $10 Million Reward for Chinese Hacker Accused of Stealing COVID-19 Research
The U.S. State Department is offering up to $10 million for information on Zhang Yu, a Chinese national accused of hacking COVID-19 research at U.S. universities on behalf of China's Ministry of State Security. Zhang and his alleged partner, Xu Zewei, are also tied to the 2021 HAFNIUM campaign, which exploited Microsoft Exchange vulnerabilities to compromise more than 12,700 U.S. entities. Xu was arrested in Italy in 2025 and extradited to the U.S. in April 2026. Zhang remains at large. Read more…
Japan to Launch Threat Hunting Program to Find Hidden Attackers in Critical Infrastructure
Japan plans to partner with private companies in fiscal 2027 to proactively look for attackers who may already be sitting undetected inside power, telecom, and other critical infrastructure networks. The National Cybersecurity Office will build detection methods by recreating attack scenarios in a virtual environment and will share them with operators. The Defense Ministry will provide experienced personnel to companies on request. Read more…
Nikkei Hit by Two Breaches as Hijacked Accounts Send 9,000 Malicious Emails
Japanese publisher Nikkei disclosed on October 4 that attackers had taken over employees' Microsoft 365 accounts. On September 30, they used those accounts to send roughly 9,000 emails with malicious links to staff and external contacts. Nikkei also revealed a separate breach of its Google Workspace accounts, ongoing since late July, that may have exposed the names and email addresses of 1,646 employees and business partners. Read more…
Agentic AI Turns Cybersecurity Into a Race of Decision Speed
In an opinion piece, Cyble's Salleh Kodri argues that security teams no longer struggle to see threats. Their problem is "decision latency": the time it takes to turn alerts from many tools into the right action. As AI accelerates attackers' reconnaissance and decision-making, Kodri says defenders should use AI to correlate intelligence and act faster. Read more…
Andover Confirms Attackers Accessed Town Systems in August Cyberattack
Officials in Andover, Massachusetts, confirmed that the August 13 cyberattack involved unauthorized access to some town systems. They have not yet determined whether any data was stolen or whether personal information was involved. The town says it paid no ransom. It has hired a law firm and cybersecurity firm Vector3 to investigate, with costs covered by cyber insurance. Read more…
Weekly Cybersecurity Takeaway
Several of this week’s incidents started with access that looked legitimate. In Denmark, attackers abused a private company’s authorized connection to the national register instead of breaking in. At Nikkei, hijacked employee accounts sent thousands of malicious emails under a trusted name.Time is the other common thread. Nikkei’s Google Workspace breach ran for over two months before disclosure, and Andover still doesn’t know what was taken. Japan’s threat hunting plan assumes attackers may already be inside, and Kodri warns that spotting an alert means little if acting on it takes too long.Organizations should monitor third-party access as closely as their own staff’s. They should secure email accounts with phishing-resistant authentication and actively hunt for intruders rather than wait for alerts.
Japan is stepping up its plans to find cyber attackers who may already be inside the networks that keep essential services running. Under a new fiscal 2027 initiative, the government plans to work with private companies to strengthen Japan threat hunting across critical infrastructure, including power utilities and telecommunications operators.
The focus is not only on stopping attacks after they are detected, but on finding signs that an attacker has gained access and is quietly moving through a system without triggering an alert.
The government will develop ways to detect these threats and share the methods with private-sector operators, while the Defense Ministry will be able to provide personnel to assist companies when requested.
Japan Threat Hunting to Target Hidden Cyber Threats
The initiative forms part of Japan’s broader active cyber defense efforts. Threat hunting involves actively searching systems for signs of malicious activity rather than waiting for an alert or confirmed attack.
Japan’s National Cybersecurity Office plans to use information about potential threats to recreate attack scenarios in a virtual environment. The office will then develop and test detection methods that can be used by private-sector companies.
The aim is to help critical infrastructure operators identify attackers that may have already entered their systems and remained undetected. Detecting such activity could also help reduce the risk of a cyberattack disrupting essential services during an emergency.
Legislation related to active cyber defense took effect on Thursday, giving the government a framework for expanding these cybersecurity measures.
Defense Ministry to Assist Critical Infrastructure Operators
Japan’s Defense Ministry is also preparing to provide direct support to operators of critical infrastructure.
Companies will be able to request assistance, after which the ministry could dispatch personnel with threat-hunting experience developed through the information systems of Japan’s Self-Defense Forces.
The National Cybersecurity Office and Defense Ministry have included the related costs in their fiscal 2027 budget requests.
Threat hunting can require considerable resources because security teams need to collect and examine large amounts of system event logs. The purpose is to identify unusual activity that may otherwise go unnoticed.
NTT Data Japan has been carrying out proactive threat hunting on its own systems since 2024. The company checks system logs for suspicious activity even when there has been no security alert.
A representative of the National Cybersecurity Office also said threat-hunting methods could help address ransomware. Such attacks can involve attackers exploring a victim’s systems after gaining initial access, meaning suspicious activity may exist before the ransomware itself is deployed.
Recent Cyberattacks Add to Japan’s Concerns
Japan’s planned expansion of threat hunting comes as cyber incidents have affected government networks and companies across different sectors.
In September 2026, the government disclosed that its common infrastructure network had been targeted in a cyberattack that began in May. Digital Minister Hisashi Matsumoto said about 246,000 personal records could have been leaked.
The affected Government Solution Service, or GSS, is used by government agencies and independent administrative agencies. The potentially exposed information included about 189,000 employee records and around 57,000 records belonging to businesses and individuals involved in agency operations.
An analysis found that a third party had compromised the system by exploiting a bypass involving a virtual private network, or VPN.
Other recent incidents have affected private-sector operations. The Nichirei cyberattack in July disrupted food deliveries after the frozen food and logistics company confirmed unauthorized access to its servers. The incident affected logistics operations supporting KFC Japan.
Nihon Kotsu also recently reported a malware-related incident that disrupted taxi dispatch services after parts of its IT infrastructure were taken offline.
Earlier incidents involving Aflac Japan, KDDI, Sapporo Holdings and Nidec showed that attackers could gain access through subsidiaries, overseas operations or third-party infrastructure.
Japan’s fiscal 2027 plans therefore put greater emphasis on looking for attackers that may already be inside a network, rather than relying only on alerts after suspicious activity has become visible.
ASEC Blog publishes Ransom & Dark Web Issues Week 1, October 2026 Dutch Police Confirm Arrest of 24-Year-Old Man in ShinyHunters Hacking Investigation [1] [2] Ulose Claims Data Leak from a South Korean General Hospital Qilin Ransomware Attack on a Japanese Freight and Logistics Company
Times Mobility says a data breach exposed data linked to 6.6 million accounts, including 1.6 million identity records with driver's license images and documents too.
Purpose and Scope This report summarizes statistics on new ransomware samples, affected systems, and statistics on targeted businesses collected during the month of August 2026, as well as major Korean & Global ransomware issues. Statistics on targeted businesses were compiled based on the time when publicly available information from ransomware groups’ DLS (Dedicated Leak Sites, […]
ASEC Blog publishes Ransom & Dark Web Issues Week 4, September 2026 Metaencryptor Ransomware Attack on a South Korean Camera Module and Equipment Manufacturer Metaencryptor Ransomware Attack on a Japanese Automotive Parts Manufacturer ShinyHunters Claims Breach of a U.S. Federal Law Enforcement Agency and Theft of Sensitive Data
ASEC Blog publishes Ransom & Dark Web Issues Week 3, September 2026 Internal Data of a Japanese Pharmaceutical and Healthcare Company Offered for Sale Following a Cyber Incident Customer Data of a South Korean E-Commerce and Retail Company Offered for Sale AUDIT TEAM Ransomware Attacks on Two South Korean Organizations
Japan ‘s Digital Agency disclosed a VPN breach exposing 246,000 government employee records across 23 ministries. Detected June 25, publicly disclosed September 11.
Japan ‘s Digital Agency disclosed that attackers exploited a vulnerability in a VPN device to access its Government Solution Service (GSS), potentially leaking personal information belonging to approximately 246,000 government employees, public officials, and contractors. The breach was detected on June 25 and confirmed as a VPN exploitation on July 9, meaning the public disclosure came 78 days after the initial detection and 63 days after the intrusion method was identified.
“It has come to our attention that, due to unauthorized external access, some files containing personal information handled on the Government Solution Service (GSS), operated by the Digital Agency, may have been leaked to an external party.” reads the advisory. “We have confirmed that the personal information that may have been leaked pertains to employees of various ministries and agencies that use GSS (hereinafter referred to as “GSS user organizations”) and those involved in their work, and does not include personal information of the general public.”
GSS connects 23 Japanese ministries and agencies through shared IT infrastructure. A breach of this platform could potentially affect many government organizations at once.
The attack followed a straightforward path. An outsider exploited a vulnerability in a VPN device that serves the GSS network, accessed the system using a maintenance and operations staff member’s account, and browsed a large number of files on the server. The agency detected the unusual activity on June 25, confirmed the VPN exploitation on July 9, then suspended the maintenance account and cut off external communications from the compromised hardware the same day. A subsequent investigation with external security specialists confirmed that files containing personal information may have been exfiltrated.
“On June 25, 2026, we detected that a large number of files on the server had been accessed using the account of a maintenance and operations staff member, and we began an investigation. On July 9, it was discovered that a third party had exploited a vulnerability in the network connection device (VPN) to infiltrate the system and gain unauthorized access. On the same day, we suspended the maintenance and operations staff member’s account and cut off communication between the compromised equipment and the outside world to prevent further unauthorized access.” continues the report.”As a result of our investigation with the cooperation of an external expert company, we have confirmed that there is a possibility that personal information may have been leaked to an external party.”
The potentially exposed data breaks down to roughly 236,000 names, 231,000 email addresses, 94,000 phone numbers, and approximately 1,000 physical addresses. Of the 246,000 total records, about 189,000 belong to employees of GSS-using organizations and public officials involved in their work, including staff at independent administrative agencies. The remaining 57,000 records relate to businesses and individuals contracted to support those organizations. The data doesn’t include My Number identification numbers, financial institution account numbers, or pension numbers.
The VPN flaw was rated medium severity and wasn’t a zero-day. A patch was already available when attackers exploited it, but the agency hasn’t revealed the VPN product or the flaw.
Japan’s privacy regulator was notified on July 15, six days after the attack was confirmed. The Digital Agency said the delay came from the difficulty of tracing the attack, assessing the affected data, and identifying those involved.
The incident also shows the risk of leaving a known, patchable flaw unaddressed on infrastructure shared by 23 ministries.
No confirmed misuse of the exposed data has been reported. However, the leaked names, email addresses and phone numbers could enable targeted phishing and social engineering, including scams impersonating Japan’s Digital Agency. The agency will contact affected people directly and warns that it will never request passwords or payments by email or phone.
The breach is one in a series of significant cybersecurity incidents affecting Japanese institutions. NISC, Japan’s National Cyber Incident Readiness and Strategy Center, disclosed a breach in 2023 that affected its email system. Japan Aerospace Exploration Agency (JAXA) reported unauthorized access to its systems in 2024. The pattern points to systemic challenges in patching and access management across Japan’s public sector infrastructure rather than isolated failures.
The Digital Agency’s planned remediation includes improved vulnerability management and changes to external connection methods, which are the right responses to the immediate incident. Whether they address the underlying governance question is harder to assess from the public advisory alone.
Entrar
