AI-assisted intrusion wave hits Japan: government, GMO, Sony and IDC Frontier breaches; 260M individuals' data exposed since April
Japan is facing a surge of AI-assisted intrusions against corporate and public-sector targets, with dozens of data leak incidents reported. On October 28, METI disclosed unauthorized access to the website of the Electricity and Gas Transaction Surveillance Commission. Hackers claimed to have published customer data from GMO Internet Group's currency trading platform, and GMO received an extortion demand of about ¥8 billion (~$50 million); no ransomware was confirmed as of October 27. Other incidents include possible exposure of data on about 125,000 National Police Agency officers and staff via cloud provider Arcadia, 2,585,481 exposed customer records at Sony Network Communications, and a ransomware attack on SoftBank-owned IDC Frontier on October 8 that disrupted 495 client organizations. Chief Cabinet Secretary Minoru Kihara said personal data on about 260 million people has been compromised since April.
Detalhes técnicos
- Experts say AI agents and open-source hacking tools help criminals analyze networks, find vulnerable targets, evade detection, automate vulnerability scanning and write phishing campaigns, and help them overcome the Japanese language barrier.
- GMO Cybersecurity by Ierae linked the China-developed testing tool ARTEX to several recent attacks. Separate research on exposed attacker infrastructure found abuse of the open-source AI-agent platform CyberStrikeAI, plus human-directed intrusions using AI for planning and tool development.
- Recently disclosed critical PHP vulnerabilities triggered millions of attempts and took government and company sites offline in Japan and Europe (no CVE given in the article).
- TrendAI counted 723 incidents in the year to October 20, above the full-year totals for 2024 and 2025. Reported leak cases rose from 303 in September to 830 in October. Macnica reports suspected website/app breaches rose from a monthly average of 6 in H1 to 23 per month since July.
- Small, cash-rich firms with weak IT security are especially attractive targets.
Remediação
- Patch PHP and other internet-facing software immediately and audit public websites and apps for exposed entry points.
- Harden cloud and desktop services, enforce multi-factor authentication, and monitor for AI-driven scanning and mass credential testing.
- Prepare incident response and breach-notification plans.
- Government response: PM Sanae Takaichi promised an emergency cybersecurity package, METI plans an AI-driven "white hat" team within IPA from November, and Japan activated its Active Cyber Defence framework on October 1.
Linha do tempo
-
AI-assisted intrusion wave hits Japan: government, GMO, Sony and IDC Frontier breaches; 260M individuals' data exposed since April
ler a análise desta fonte ocultar
Japan is facing a surge of AI-assisted intrusions against corporate and public-sector targets, with dozens of data leak incidents reported. On October 28, METI disclosed unauthorized access to the website of the Electricity and Gas Transaction Surveillance Commission. Hackers claimed to have published customer data from GMO Internet Group's currency trading platform, and GMO received an extortion demand of about ¥8 billion (~$50 million); no ransomware was confirmed as of October 27. Other incidents include possible exposure of data on about 125,000 National Police Agency officers and staff via cloud provider Arcadia, 2,585,481 exposed customer records at Sony Network Communications, and a ransomware attack on SoftBank-owned IDC Frontier on October 8 that disrupted 495 client organizations. Chief Cabinet Secretary Minoru Kihara said personal data on about 260 million people has been compromised since April.
Technical Details
- Experts say AI agents and open-source hacking tools help criminals analyze networks, find vulnerable targets, evade detection, automate vulnerability scanning and write phishing campaigns, and help them overcome the Japanese language barrier.
- GMO Cybersecurity by Ierae linked the China-developed testing tool ARTEX to several recent attacks. Separate research on exposed attacker infrastructure found abuse of the open-source AI-agent platform CyberStrikeAI, plus human-directed intrusions using AI for planning and tool development.
- Recently disclosed critical PHP vulnerabilities triggered millions of attempts and took government and company sites offline in Japan and Europe (no CVE given in the article).
- TrendAI counted 723 incidents in the year to October 20, above the full-year totals for 2024 and 2025. Reported leak cases rose from 303 in September to 830 in October. Macnica reports suspected website/app breaches rose from a monthly average of 6 in H1 to 23 per month since July.
- Small, cash-rich firms with weak IT security are especially attractive targets.
Remediation
- Patch PHP and other internet-facing software immediately and audit public websites and apps for exposed entry points.
- Harden cloud and desktop services, enforce multi-factor authentication, and monitor for AI-driven scanning and mass credential testing.
- Prepare incident response and breach-notification plans.
- Government response: PM Sanae Takaichi promised an emergency cybersecurity package, METI plans an AI-driven "white hat" team within IPA from November, and Japan activated its Active Cyber Defence framework on October 1.