Reports of cyberattacks against organizations in Japan rose 48% between the second and third quarters of 2026, from 621 to 918, according to a new report from Recorded Future's Insikt Group. The researchers say the trend has carried into October.
The figures come from the Recorded Future Intelligence Platform, and Insikt Group says they were later borne out by Masaaki Taira, head of Japan's National Cybersecurity Strategy Headquarters (NCSH), who declared a "state of emergency in cyberspace" after a run of high-profile breaches.
Wider targets, and a far bigger blast radius
Insikt Group singles out two features of the third-quarter breaches. The first is breadth: victims spanned retail, rail, logistics, media, education and software, and the intrusions involved ransomware, stolen cloud credentials and exploited web-facing systems. The second is scale. Single incidents now routinely touch millions of records or many downstream customers, such as roughly 33 million records leaked from the EPARK PeakManager reservation platform in July and 6.6 million accounts from Times Car in September.
October has followed the same pattern. On October 7, a ransomware incident at Japanese cloud provider IDCFrontier disrupted 495 companies and local governments. On October 13, an unidentified third party misused software company Sourcenext's member information retrieval API to take 22,519,960 customer records, including email addresses, passwords, names, addresses, phone numbers, dates of birth and employment information.
The same four tactics keep showing up
The report lines up with October warnings from JPCERT/CC, the Personal Information Protection Commission and the IPA. JPCERT/CC's notice described four recurring tactics: exploitation of known vulnerabilities in unpatched or misconfigured systems; attacks on internal and external APIs, sometimes with stolen API credentials; exploitation of CVE-2026-72898 (CVSS 10), a SQL injection flaw in Metabase that we covered in August; and web shells planted in .war and .jsp files on internet-facing servers. JPCERT/CC has since traced some of the leaks to attackers mining Android apps for their APIs.
Japan-based Macnica Security, cited in the report, sees the same surge from a different angle: of 119 personal-information leak cases disclosed in 2026, about 68% were announced since July. Macnica says the increase is unique to Japan, but it could not confirm the use of AI in the attacks.
Why Japan, and why now?
Insikt Group assesses that several factors are likely at work. Japanese personal data commands a premium in criminal markets. Legacy systems remain common, with a Money Forward article cited in the report putting the share of Japanese firms still running legacy or end-of-life software above 60%. And commercial AI products are widely believed to have helped attackers automate scanning and exploitation and get past the language barrier in phishing, although the specific models have not been confirmed.
The report notes that GMO Cybersecurity by Ierae reportedly concluded on October 19 that ARTEX, a Chinese open-source AI penetration-testing tool attributed to a group Recorded Future tracks as TAG-217, was used against roughly 80 Japanese companies. The same tool was previously tied to intrusions at South Korean financial institutions.
Japan's Active Cyber Defense law, in force since October 1, adds mandatory incident reporting for designated critical infrastructure operators. Insikt says it is unlikely to explain the third-quarter surge, but expects it to keep disclosure numbers high from here on.
Fix legacy systems and lock down APIs first
Insikt Group recommends that organizations in Japan:
- Replace or update legacy and end-of-life systems.
- Patch internet-facing VPNs, firewalls, routers, cameras and similar devices, and restrict administrative access to them.
- Authorize every API request, test whether one user can reach another customer's records, restrict API key privileges and limit bulk data retrieval.
- Require phishing-resistant MFA and train staff to spot well-crafted Japanese-language phishing.
- Delete personal data that is not needed, test restoration from protected backups, and grant administrator rights only on a just-in-time basis.
The Sourcenext case is the clearest lesson in the set: no exotic exploit, just an API that answered too many questions for whoever asked. For more on the country's threat picture, see our Japan profile.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.