Surge in cyberattacks on Japan: 48% rise in Q3 2026, mass data breaches and 'state of emergency in cyberspace' declared
Insikt Group (Recorded Future) observed a 48% rise in reported cyberattacks on Japanese organizations between Q2 and Q3 2026, from 621 to 918 incidents. Masaaki Taira, head of Japan's NCSH, declared a "state of emergency in cyberspace". Victims span retail, rail, logistics, media, education and software. Incidents involved ransomware, stolen cloud credentials and exploited web-facing systems, and single incidents now affect millions of records, such as ~33 million from EPARK PeakManager and 6.6 million accounts from Times Car. The trend continued in Q4 with a ransomware attack on IDCFrontier (495 companies and local governments disrupted, October 7) and the Sourcenext breach (22,519,960 customer records, October 13, via misuse of a member information retrieval API).
Entenda a falha
A vulnerabilidade
CVE-2026-72898 is a SQL injection flaw in the Metabase application, rated CVSS 10. JPCERT/CC lists its exploitation as one of four recurring tactics in recent attacks on Japanese organizations. The articles do not say what an attacker needs (authentication, configuration, network reach) or what exactly they get. They also give no affected or fixed versions. Separately, the story mentions misuse of Sourcenext's member information retrieval API, but that is described as an API access-control problem, not a CVE.
Como funciona
The articles do not describe how the Metabase flaw works step by step. In general terms, a SQL injection means input reaches a database query in a way that lets it alter the query. The sources give no detail on the entry point or the step where Metabase fails.
Por que é vulnerável
The articles do not state the root cause beyond classifying the bug as SQL injection, and they say nothing about why it went unnoticed or what the fix changes. The wider context they give is that many of the attacks exploit known vulnerabilities in unpatched or misconfigured systems.
Como foi descoberta
The articles do not say who found CVE-2026-72898 or how it was reported. What they say is that JPCERT/CC, in an October 2026 notice, named its exploitation among the recurring TTPs seen in recent incidents in Japan. Recorded Future's Insikt Group relayed that warning in its report published October 22, 2026.
Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 20:16.
Detalhes técnicos
- JPCERT/CC warned of four recurring TTPs: exploitation of known vulnerabilities in unpatched or misconfigured systems; attacks on internal and external APIs, sometimes with stolen API credentials; exploitation of CVE-2026-72898 (CVSS 10, SQL injection in Metabase); and deployment of web shells in .war and .jsp files on internet-accessible web servers.
- Later reports linked some attacks on Japanese company websites to AI agents, ranging from basic scanning to extended multi-tool attack sequences. Macnica could not confirm AI use. It reported that ~68% of the 119 cases disclosed in 2026 were announced since July, and cited weak authentication, stolen credentials, exploited vulnerabilities and flaws in application design, APIs or access controls.
- GMO Cybersecurity by Ierae reportedly concluded on October 19 that ARTEX, a Chinese open-source AI penetration-testing tool attributed by Recorded Future to TAG-217, was used against roughly 80 Japanese companies, 8 of them in the prior 30 days. ARTEX was also used against South Korean financial institutions.
- Insikt Group cites these drivers: strong criminal demand for Japanese user data, widespread legacy and end-of-life systems (over 60% of firms per Money Forward), AI tooling that automates attacks and improves Japanese-language phishing, and the new Active Cyber Defense (ACD) Law (effective October 1, 2026), which may increase disclosures.
- Trend Micro reported that attacks on Japan from January to September 2026 exceeded the total for 2025.
Remediação
- Migrate away from or update legacy and end-of-life systems.
- Harden internet-facing systems (VPNs, WAFs, load balancers, routers, IP cameras, DVRs): patch, restrict administrative access, enable logging and disable unneeded services.
- Strengthen API controls: verify authorization on every request, test for cross-customer access, restrict API key privileges and limit bulk retrieval.
- Require phishing-resistant MFA and train staff on Japanese-language phishing.
- Minimize stored personal data, restrict export permissions, test restores from protected backups and prepare manual fallbacks for critical services.
- Adopt PAM with just-in-time elevated rights.
Linha do tempo
-
Surge in cyberattacks on Japan: 48% rise in Q3 2026, mass data breaches and 'state of emergency in cyberspace' declared
ler a análise desta fonte ocultar
Insikt Group (Recorded Future) observed a 48% rise in reported cyberattacks on Japanese organizations between Q2 and Q3 2026, from 621 to 918 incidents. Masaaki Taira, head of Japan's NCSH, declared a "state of emergency in cyberspace". Victims span retail, rail, logistics, media, education and software. Incidents involved ransomware, stolen cloud credentials and exploited web-facing systems, and single incidents now affect millions of records, such as ~33 million from EPARK PeakManager and 6.6 million accounts from Times Car. The trend continued in Q4 with a ransomware attack on IDCFrontier (495 companies and local governments disrupted, October 7) and the Sourcenext breach (22,519,960 customer records, October 13, via misuse of a member information retrieval API).
Technical Details
- JPCERT/CC warned of four recurring TTPs: exploitation of known vulnerabilities in unpatched or misconfigured systems; attacks on internal and external APIs, sometimes with stolen API credentials; exploitation of CVE-2026-72898 (CVSS 10, SQL injection in Metabase); and deployment of web shells in .war and .jsp files on internet-accessible web servers.
- Later reports linked some attacks on Japanese company websites to AI agents, ranging from basic scanning to extended multi-tool attack sequences. Macnica could not confirm AI use. It reported that ~68% of the 119 cases disclosed in 2026 were announced since July, and cited weak authentication, stolen credentials, exploited vulnerabilities and flaws in application design, APIs or access controls.
- GMO Cybersecurity by Ierae reportedly concluded on October 19 that ARTEX, a Chinese open-source AI penetration-testing tool attributed by Recorded Future to TAG-217, was used against roughly 80 Japanese companies, 8 of them in the prior 30 days. ARTEX was also used against South Korean financial institutions.
- Insikt Group cites these drivers: strong criminal demand for Japanese user data, widespread legacy and end-of-life systems (over 60% of firms per Money Forward), AI tooling that automates attacks and improves Japanese-language phishing, and the new Active Cyber Defense (ACD) Law (effective October 1, 2026), which may increase disclosures.
- Trend Micro reported that attacks on Japan from January to September 2026 exceeded the total for 2025.
Remediation
- Migrate away from or update legacy and end-of-life systems.
- Harden internet-facing systems (VPNs, WAFs, load balancers, routers, IP cameras, DVRs): patch, restrict administrative access, enable logging and disable unneeded services.
- Strengthen API controls: verify authorization on every request, test for cross-customer access, restrict API key privileges and limit bulk retrieval.
- Require phishing-resistant MFA and train staff on Japanese-language phishing.
- Minimize stored personal data, restrict export permissions, test restores from protected backups and prepare manual fallbacks for critical services.
- Adopt PAM with just-in-time elevated rights.