JPCERT/CC issued alert JPCERT-AT-2026-0030 on 8 October 2026 about a run of unauthorised-access incidents that leaked large amounts of personal data from Japanese organisations around September 2026. It names no attacker or victim and calls its picture limited and fragmentary. It describes three patterns: attackers pulling API keys from smartphone apps and calling APIs in ways that look like normal use, then hunting for APIs that return too much data, have excessive privileges, expose member functions to anonymous users or mishandle sessions (weak admin passwords and known flaws were also seen); attackers scanning each target for a range of known flaws and stealing configuration and backup files; and exploitation of CVE-2026-72898, the unauthenticated Metabase SQL injection (CVSS 10.0) that was a zero-day against Metabase's own cloud in August and is on CISA's KEV list.

Targets include consumer apps, business intelligence tools and staff-facing management systems their operators never meant to be public. The alert lists eight source IP addresses, five User-Agent strings and API controls such as access checks on every endpoint, public or not.

The security research centre of Macnica, cited by the alert, counted 119 publicly reported web-system personal data leaks in Japan this year to 6 October (84 in all of 2025, 62 in 2024), 81 of them since July. Primary: JPCERT/CC (Japanese); wire: The Hacker News.

UPDATE (13 Oct): Japan's government has since responded across agencies. The Cabinet Secretariat's National Cybersecurity Office (NCO) issued an advisory dated 9 October 2026 saying it had confirmed multiple cases in which systems of companies handling large volumes of personal data were breached through web-system vulnerabilities, supply-chain compromise and weak data management. It asks those companies to patch promptly (including internal servers), retire unsupported products, use MFA, trim admin accounts, keep and watch logs, and check contractors and sub-contractors, and to share technical details with the NCO or their ministry.

Jiji Press reported that cybersecurity minister Toshiharu Furukawa chaired the first cross-ministry meeting on the leaks on 8 October and told agencies to report leaks to the NCO so information is held centrally; the NCO said attacks on private companies began rising in August and that defenders should assume attackers use AI.

The Financial Services Agency warned financial institutions on 9 October that recent breaches leaked customer data including images of identity documents such as driver's licences, and asked them to guard against impersonation in remote identity checks. The advisories are requests, not new legal duties.

Primary: NCO advisory (Japanese PDF); FSA notice; Jiji Press.