Cyberattacks Are Skyrocketing in Japan as Researchers Trace AI-Assisted Intrusions

Japan is facing an extraordinary surge in cyberattacks, with a record 233 security incidents publicly disclosed in October alone. That's roughly 2.4 times the previous monthly record, according to Trend Micro data reported by TV Asahi. Cyberattacks are rising around the world, but the pace of disclosures in Japan is staggering. Nearly every day has dragged another affected company, service provider, or public institution into the headlines.

The volume of exposed information is growing even faster. An analysis by MM Research Institute estimates that approximately 185 million personal information records were exposed or potentially exposed in incidents disclosed during October, nearly four times the total reported for all of 2025. The number of large breaches has also increased sharply, with 30 incidents involving at least one million records disclosed in October.

The disclosures have implicated major retailers, technology companies, financial services providers, and government agencies. On November 9, Japanese furniture giant Nitori disclosed that unauthorized access to its systems may have exposed up to 37.62 million customer information records. Days earlier, email service provider Arara confirmed an intrusion affecting more than 81 million email addresses and potentially hundreds of corporate customers.

Japan's government has announced emergency cybersecurity measures as researchers dig into why so many attacks are succeeding and what's driving the sudden spike.

In an October analysis of Japanese security incidents, TrendAI counted 607 publicly disclosed incidents from January through September 2026, already exceeding the 594 reported during all of 2025.

Yet ransomware disclosures barely moved in TrendAI's dataset. Researchers counted 82 publicly disclosed ransomware incidents during the first nine months of 2026, compared with 79 during the same period last year.

Unauthorized access accounted for 331 incidents in TrendAI's analysis, more than half of the total. Another 62 involved what TrendAI calls data supply chain incidents, in which an organization entrusted with information suffers an attack and its customers subsequently report their own exposure.

A separate investigation by Japanese cybersecurity firm Macnica illustrates just how dramatically web application breaches have increased. Researchers identified 288 incidents involving unauthorized access to web systems and potential data theft through October 2026, compared with 84 during all of 2025. October alone accounted for 168 disclosures.

Macnica excluded ransomware, credential-stuffing attacks, and duplicate disclosures from customers affected by the same compromised provider. Its research found that attacks have expanded well beyond traditional ecommerce targets to membership portals, business applications, and specialized services.

Some of the targets are surprisingly obscure. Macnica documented breaches involving:

• A regional table tennis association's tournament registration system: 185 organizers
• A tourist train's seat reservation system: Approximately 1,400 passengers
• A funeral company's flower-ordering system: Roughly 10,000 records
• An event ticket refund system: Approximately 1,500 records
• A fashion magazine's blogger management system: About 2,800 people

These incidents, disclosed between July and October, show how far the attacks have spread beyond major retailers and technology companies. Membership portals and business or administrative systems accounted for roughly two-thirds of the October web-system incidents Macnica tracked.

Researchers also found evidence of successful intrusions continuing into late October, indicating that the spike wasn't simply the result of organizations discovering and reporting older compromises.

The breach at Japanese email distribution provider Arara demonstrates how an intrusion at a single company can spread through an extensive network of business customers.

In an updated disclosure on November 6, Arara confirmed that attackers had obtained approximately 81.3 million email addresses, with up to 380 corporate customers potentially affected. Depending on the customer, the exposed information may also have included names, dates of birth, phone numbers, addresses, and membership information.

Attackers also used Arara's email distribution service to send as many as 7.13 million fraudulent messages impersonating credit card companies between October 28 and October 30.

The company suspended the affected service on October 31 while investigating the intrusion.

On November 9, Japanese gaming giant SEGA disclosed that approximately 2.2 million newsletter email addresses were exposed through Arara. Other affected organizations include major retailers and service providers that relied on the same email infrastructure.

Arara wasn't the only Japanese email distribution provider hit. On October 19, Ymir Link disclosed an intrusion into its Cuenote FC service. In a November 11 update, the company confirmed that attackers had extracted approximately 47.9 million email distribution records from 49 systems. Investigators found that attackers exploited software vulnerabilities, stole session information, and abused legitimate CSV export functions to extract customer data.

The Arara breach left hundreds of companies dealing with the fallout of an attack on systems they didn't operate. A company whose own systems remain secure may still need to notify customers, investigate potential exposure, and address the consequences of an intrusion at a service provider.

The reasons behind Japan's sudden increase remain under investigation, but researchers have identified evidence that artificial intelligence is being used to help attackers discover and exploit vulnerabilities.

In an October 21 technical investigation, Japan's Computer Emergency Response Team Coordination Center, JPCERT/CC, confirmed that attackers had used AI to scan for known vulnerabilities and conduct attacks through APIs.

Investigators examining attack infrastructure found that attackers had analyzed Android application packages to identify API endpoints and test them for weaknesses, including server-side request forgery (SSRF).

On another attack server, researchers found Blutter and jadx, tools used to reverse-engineer Android and Flutter applications. Analyzing these apps can reveal API endpoints and authentication mechanisms, allowing attackers to probe backend services for weaknesses that aren't obvious from the public website.

The attacks go beyond known vulnerabilities. Macnica's investigation found attackers exploiting authentication and access-control weaknesses specific to individual applications. Finding these issues has traditionally required considerable effort, but AI-assisted analysis and automation can accelerate the process across many targets.

TrendAI researchers have also observed suspicious files containing artifacts consistent with AI-generated code and attack attempts that rapidly adjusted after initial failures.

While researchers have confirmed AI-assisted attacks, they haven't established how much AI is contributing to Japan's broader cyberattack surge. JPCERT/CC also found that some of the infrastructure it investigated targeted services outside Japan, suggesting these techniques are not limited to Japanese organizations.

The surge has prompted Japan's government to examine how quickly organizations receive information about software vulnerabilities and can respond before attackers exploit them.

According to a November 5 Reuters report citing Nikkei, Japan plans to seek earlier access to information about undisclosed software vulnerabilities from US AI developers and other overseas technology companies.

The government is exploring arrangements that would give agencies and critical infrastructure operators advance warning of serious vulnerabilities, allowing them more time to prepare patches or other mitigations before public disclosure.

The effort follows a disruptive October incident involving critical vulnerabilities in PHP, which is particularly prevalent in Japan. According to W3Techs, PHP runs on approximately 92% of websites hosted in Japan whose server-side language can be identified, compared with 69% globally. One reason is the popularity of WordPress in Japan. The content management system powers 88% of Japan-hosted websites with an identifiable CMS, compared with approximately 58% worldwide.

Exploitation attempts began before the PHP vulnerabilities were publicly disclosed on October 21, and millions of subsequent attempts forced some website operators to patch urgently or temporarily take their systems offline.

The pressure to respond faster extends beyond newly discovered vulnerabilities. On November 5, Japan's National Cybersecurity Office warned businesses that several recent breaches appeared to involve inadequate security practices, including continued use of unsupported software and known vulnerabilities that had not been patched.

The guidance calls on organizations to maintain visibility into their software components, establish priorities and deadlines for fixing vulnerabilities, and prepare procedures for responding when serious vulnerabilities are discovered in open source software and external libraries. It also addresses security weaknesses in APIs and systems operated by outside contractors.

The following day, Prime Minister Sanae Takaichi's administration announced a 10 billion yen ($63 million) emergency cybersecurity package. The measures include expanded intelligence gathering, AI-assisted vulnerability detection, stronger coordination between government and industry, and additional support for organizations responding to attacks.

Japan is pushing for earlier vulnerability warnings as attackers find and exploit weaknesses faster than organizations can patch them, including vulnerabilities that have already been known for some time.

There has also been speculation about state-backed involvement. Kyodo News reported that GMO Internet Group's investigation pointed to a North Korea-linked hacking group in its October breach, but no public evidence has linked Japan's broader cyberattack wave to a single state-sponsored campaign. The incidents involve different systems, techniques, and circumstances, and many investigations remain ongoing.

For organizations trying to keep pace, patching faster requires knowing which software components and open source dependencies they run, where they're used, and which vulnerabilities need attention first. Japan is now seeking access to vulnerability intelligence before public disclosure, while urging businesses to address known weaknesses more quickly. The pressure is mounting after a month of record breaches, with November already bringing another wave of major disclosures.