Japan Data Breaches 2026: Inside the October Surge
Japan is facing a dense wave of breach disclosures. Since late September, at least 20 major Japanese companies have reported breaches, including Times Car, Lawson, Yakiniku King, Sourcenext and Burger King Japan, and a ransomware attack on SoftBank’s IDC Frontier cloud took 495 customer organizations offline. Between September 25 and October 8 alone, at least 36 Japanese organizations issued a first breach notice, and new notices kept arriving after mid-October from Yamato Transport, Nikkei and email delivery provider Ymirlink, among others. On October 19, a Japanese security firm tied part of the wave to a Chinese-developed AI penetration-testing tool.
SOCRadar’s own Dark Web News data reflects the same spike. Items on Japan reached 134 in the first 15 days of October, already more than all of September, at twice September’s daily rate.
This post breaks down what happened, how attackers got in, why the wave is hitting now, what the new AI findings show, where ransomware fits, and what defenders in Japan should do next.
Key Takeaways
- -SOCRadar Dark Web News logged 134 items on Japan from October 1 to 15, 2026, more than all of September (129) and twice its daily rate
- -Disclosed compromises of Japanese web systems rose from 84 in all of 2025 to 119 by October 6, 2026, with 81 of them after July 1
- -Where entry points were disclosed, internet-facing web services, contractors and shared software led; single suppliers such as IDC Frontier and Scala Communications exposed many organizations at once
- -A security firm linked part of the wave to AI: attack infrastructure that targeted about 20 Japanese companies, eight of which have disclosed breaches, carried traces of ARTEX, a Chinese-developed AI penetration-testing tool
- -Ransomware stayed steady: leak sites named 6 to 17 Japanese victims a month in 2026, and The Gentlemen overtook Qilin as the most active group against Japan
- -No formal state of emergency was declared; the government responded with advisories from the National —-Cybersecurity Office, the Financial Services Agency and NICT, and IPA opened a special help desk for affected organizations
SOCRadar Dark Web News Shows a Record October Pace
SOCRadar Dark Web News tracks underground and threat news activity tied to Japanese organizations. Volume climbed through 2026, from 24 items in January to a plateau of 120 to 152 items a month between June and September. October broke out of that plateau.
In its first 15 days, October logged 134 items, an average of 8.9 a day against 4.3 in September. At that pace, October will pass July (152), the busiest month of the year so far. The spike coincides with the cluster of corporate breach disclosures and government warnings that followed.
Timeline of the Japan Breach Wave
The wave built over three weeks. Times Car’s disclosure on September 25 was followed by new breach notices almost daily, and the IDC Frontier ransomware attack on October 7 turned a string of company incidents into a national story.
The largest disclosed incidents through October 19, with the maximum record counts each organization stated, are below. Details come from company notices compiled by a public incident tracker unless linked otherwise.
| Organization | Disclosed | Records (max stated) | Entry point |
|---|---|---|---|
| Sourcenext | Oct 15 | 22.52M | Member-data API abused from Oct 9 to Oct 13 (disclosure) |
| skyticket | Oct 9 | 14.64M | Admin function manipulated; three incidents through three different routes |
| Burger King Japan | Oct 15 | 11.18M | Official app member system (reporting) |
| Yakiniku King (Monogatari) | Oct 5 | 10.79M | App member management system; route under investigation |
| Ymirlink | Oct 19 | about 9M (cumulative estimate) | Vulnerability used to steal a support-staff login, then malware exported data from five systems (disclosure) |
| Daiichikosho | Oct 8 | 8.72M | Malware on one PC at a contractor holding customer data |
| Times Car (Park24) | Sep 25 | 6.6M accounts, 1.6M ID images | Web system; a roughly 20-year-old system was still in service (reporting) |
| Ride On Express | Oct 13 | 6.5M | Server hosting provider hit by ransomware |
| Bookoff | Oct 9 | 6.43M | Subsidiary member system; route not disclosed |
| Yamato Transport | Oct 16 | 5.26M | Kuroneko deferred-payment service; route not disclosed (reporting) |
| Lawson | Oct 8 | 2.16M | App-linked data display mechanism abused; found by manual review |
| JR East | Oct 9 | 2.06M | Email service hosted on IDC Frontier’s cloud |
| Nikkei | Oct 16 | 1.83M (about 150,000 with personal details) | Stolen credentials used to access a development system (reporting) |
| GMO Research | Oct 5 | 894,082 | Software vulnerability; 611 fraudulent point exchanges followed |
| Daiwa Securities | Oct 5 | about 110,000 | Contractor’s FAQ system: admin login, then a planted program read client databases |
| IDC Frontier | Oct 7 | 495 customer organizations | Ransomware on the cloud platform; route not disclosed (reporting) |
The affected organizations span car sharing, restaurants, retail, logistics, media, rail, travel, securities, universities and cloud hosting. No single attacker has been named, but on October 19 a security firm linked eight of the disclosed breaches to one AI-driven attack infrastructure (see The AI Debate). Confirmed misuse is rare so far: GMO Research reported 611 fraudulent point exchanges worth 2.87 million yen, while most other companies report no secondary damage.
One older case also grew: E-Store’s final report on October 16 put its ShopServe breach at about 23.36 million people, larger than any count in the table above, although that intrusion ran from May to August and predates the October wave (report).
IDC Frontier’s fifth update on October 14 said it had found no evidence of data exfiltration from the affected zones, and that snapshot backups could restore data for 194 of its 495 affected customers (update). A sixth update on October 18 restarted its backup service in unaffected zones, while the snapshot function stays suspended (reporting).
How Attackers Got In
Where companies disclosed the entry point, the most common routes were internet-facing web services and suppliers or shared software. A public tracker of 78 Japanese incidents disclosed in 2026 as of October 15 tags them as follows, with some incidents carrying more than one tag; the same tracker listed 87 incidents a day later.
Three patterns stand out.
One Supplier, Many Victims
A single compromised contractor, SaaS platform or cloud host exposes every client at once:
- Scala Communications: its FAQ platform exposed up to five clients, including Daiwa Securities and Citizen Watch; at Daiwa, attackers logged in with an admin account and planted a program that read client databases
- IDC Frontier: the ransomware outage reached JR East, JR Kyushu, Izumi and hundreds of other customers, including local governments
- Commune: a breach of this community SaaS exposed members of communities run by Yamaha, Suzuki, Sansan and LINE Yahoo
- Daiichikosho: malware on one PC at a contractor holding its customer data put 8.72 million records at risk
- Studio: attackers exploited a feature flaw in this website builder’s cloud environment from September 30 to October 1, potentially exposing data for all of its customers and the sites built on it, including sites run by Saitama Prefecture (reporting)
- Ymirlink: a stolen support-staff login at this email delivery provider let attackers export about 9 million records from five systems (disclosure)
Member Apps and APIs
Member apps and APIs sit behind several of the largest exposures. Sourcenext’s breach ran through a member-data API over five days, and Burger King Japan, Yakiniku King, Lawson and Seicomart all reported incidents tied to app member systems. Lawson found its incident through manual review. On October 13, NICT warned that attackers are reverse-engineering public Android apps to map the backend APIs behind them and then exploiting server-side flaws, a technique it calls an A2B (App-to-Backend) attack, and noted that AI makes this analysis faster and cheaper (advisory).
Identity-Grade Data
Times Car lost about 1.6 million driver’s license images, the most sensitive single loss of the wave (reporting). On October 9, the Financial Services Agency asked financial institutions to scrutinize ID images more closely and to move to IC-chip identity checks ahead of the April 1, 2027 deadline (FSA).
Why Japan, Why Now
The wave is concentrated in web-facing systems and began building in early summer. Disclosed compromises of Japanese web systems rose from 62 in 2024 and 84 in 2025 to 119 by October 6, 2026, and 81 of those 119 came after July 1. Four drivers explain most of it.
- Cheaper discovery at scale: the researchers behind that count see indiscriminate collection from any site holding personal data, from major brands to university seminar houses and library catalog systems, and judge that low-cost AI tooling likely made probing at this scale practical; they describe a new actor profile outside the usual APT, ransomware and commodity-crime groups, and GMO Cybersecurity’s October 19 findings now tie part of this activity to a specific AI tool
- Weak spots that piled up: the same researchers note that web apps were deprioritized while budgets went to VPN and ransomware defense, letting small flaws accumulate; Times Car’s breach involved a roughly 20-year-old system still in service, and Japan’s IT promotion agency cites a shortfall of about 30,000+ security professionals
- Suppliers multiply the damage: one compromised contractor, SaaS or cloud provider exposes every client at once, as Scala Communications, Commune and IDC Frontier showed
- Disclosure contagion: some companies found their own breaches only after checking their systems in response to peers’ announcements, so part of the October spike is detection catching up
The AI Debate
Officials and analysts have argued that AI removed the Japanese-language barrier that once slowed foreign attackers and lowered attack costs, while a National Institute of Informatics researcher judged that AI helped automate attacks without playing a major role. On October 19, GMO Cybersecurity by IERAE published concrete evidence: traces of ARTEX, a Chinese-developed autonomous AI penetration-testing tool, on attack infrastructure that had targeted about 20 Japanese companies, nine of them in the same industry (findings). Eight of those companies had disclosed breaches in September and October. GMO found six more AI-based attack infrastructures aimed at Japanese firms in retail, education, marketing, insurance and finance, e-commerce, media and logistics, and judged that one group may be running country- and industry-specific campaigns.
GMO named neither the victims nor an actor and has shared its findings with law enforcement. The same tool was tied to attacks on South Korean financial institutions starting in late September, and its developer halted public releases on October 8 (reporting). Some Japanese headlines cite about 80 targeted companies, a figure that does not appear in GMO’s own post.
The defensible reading is now a supply-chain and identity-data crisis in which an AI tool helped at least one actor find and exploit weak web systems at scale. The weaknesses it found, from aging web apps to exposed APIs and shared suppliers, were already there.
No Formal State of Emergency
The “cyberspace emergency” phrase that spread internationally came from Masaaki Taira, head of the ruling LDP’s cybersecurity strategy headquarters, at a party meeting on October 9. It was a party characterization; the government did not declare a state of emergency.
Ransomware Against Japan in 2026: The Gentlemen Take the Lead
Ransomware is a steady background threat in Japan, and the October spike comes from data theft. Japan’s National Police Agency counted 123 ransomware cases in H1 2026, a record but only seven more than in H1 2025, with small and mid-size companies accounting for 79 and manufacturing the most affected sector at 37(NPA).
Leak-site data from SOCRadar Ransomware Intelligence shows the same stability: 117 victims tagged Japan between January 1 and October 14, 2026.
| Month (2026) | Japan victims posted |
|---|---|
| January | 6 |
| February | 15 |
| March | 12 |
| April | 12 |
| May | 17 |
| June | 10 |
| July | 9 |
| August | 14 |
| September | 15 |
| October (1-14) | 7 |
| Total | 117 |
| Group | 2026 Japan posts | Japanese victims named include |
|---|---|---|
| The Gentlemen | 22 | Aichi Electric, DHC, TOA, Omikenshi, Koa Glass |
| Qilin | 14 | Ikegami Tsushinki, Musashino University, a Denso group company |
| Everest | 9 | Nissan, UD Trucks, UNIRITA, Allied Telesis, Topcon Healthcare |
| Safepay | 7 | Mid-size IT and services firms |
| AiLock | 5 | Nihon Kotsu, Yaomasa |
| Nightspire | 5 | CERUMO, Makimura |
| Akira | 4 | GS Yuasa Lithium Power, Zojirushi |
| LockBit5 | 4 | DaikyoNishikawa |
| Metaencryptor | 3 | Nippon Steel, Astemo, Corona |
Counts include about four repeat victims and about a dozen entries tagged Japan that are not Japanese companies.
The Gentlemen Overtake Qilin
In SOCRadar’s Japan Threat Landscape Report 2026, covering July 2025 to July 2026, Qilin accounted for 41.5% of ransomware incidents targeting Japan and The Gentlemen 8.1%. In calendar 2026, The Gentlemen have posted more Japanese victims than any other group, with posts every month from January to September.
The two groups share roots. The Gentlemen’s core operators previously worked as ArmCorp, a Qilin affiliate crew whose operator publicly accused Qilin’s admins of withholding about $48,000 in July 2025 before the crew launched its own RaaS in September 2025. SOCRadar’s campaign profile notes that the group selects victims primarily by FortiGate (mis)configuration and equips affiliates with the GentleKiller EDR-killer suite, which fits its mostly mid-size Japanese manufacturing victims.
Qilin is under pressure in Japan. The National Police Agency says the group has hit 53 Japanese organizations since April 2023, and a Russian national described as a key Qilin member was detained in Osaka in May and handed to Germany in October.
Most of October’s Big Ransomware Cases Remain Unclaimed
Qilin claimed one of them on October 15, listing Keio Corporation, whose group was hit by ransomware on September 26, with 27 images of purported internal documents and a countdown to further publication. Keio said on October 16 that an attacker claiming responsibility had published some group information and that it is verifying whether the material is genuine (reporting).
No leak-site claim had been publicly reported for IDC Frontier, Osaka Metropolitan University or Ride On Express’s hosting provider as of October 19, and leak-site posts often trail attacks by weeks. In other cases the leak sites confirmed what victims later disclosed: UNIRITA, posted by Everest on September 25, confirmed on October 14 that attackers had published its data on October 12, and Ikegami Tsushinki appeared on Qilin’s site before its own first disclosure.
Hacktivism Stayed Quiet in October
Hacktivist activity against Japan in October has been limited to a few minor pro-Russian actions, mainly DDoS and CCTV access claims, with no surge alongside the breach wave. None of the October breach disclosures has been linked to a hacktivist group.
The heavier hacktivist pressure came earlier in the year. In February, SOCRadar tracked a NoName057(16) DDoSia campaign in which Japan accounted for 39.4% of all attack entries (2,144), the group’s first sustained campaign against an Asian G7 country. NoName057(16) relaunched #OpJapan on August 24, joined by Dark Storm Team.
Mitigation and Recommendations
The official guidance and the disclosed entry points point to the same priorities for organizations in Japan:
- Audit internet-facing web apps and APIs: inventory every member site, app backend and API that holds personal data, including old systems still in service and the APIs behind public mobile apps that NICT flagged, and test them for access-control and admin-function abuse, the routes behind Sourcenext, skyticket and Lawson
- Review contractors and shared platforms: follow the FSA and National Cybersecurity Office requests to recheck third-party risk; confirm which suppliers, SaaS platforms and hosting providers hold your customer data and how you would learn of a breach on their side
- Monitor for abuse, not only intrusion: add alerting on unusual data volume from member APIs and display functions, since several incidents involved legitimate functions used at scale
- Harden edge devices: patch and review FortiGate configurations, including exposure to CVE-2024-55591, and rotate VPN credentials, given The Gentlemen’s FortiGate-based victim selection
- Treat ID images as high-risk data: minimize retention of license and ID images, and move identity checks to IC-chip verification as the FSA requested
- Prepare for follow-on fraud: warn customers about phishing that reuses leaked contact details, and watch for impersonation of breached brands
- Watch the underground: track Dark Web forums, Telegram and ransomware leak sites for your organization’s name and data, since several October victims may still be posted
- Use the official support channels: IPA’s special consultation desk, opened on October 16, gives initial response advice to organizations that have been or may be affected by unauthorized access (IPA)
Read the Full Report
For the complete analysis, including the full incident timeline, ransomware tables and what to watch next, download the Japan Flash Report: The October 2026 Breach Surge.
FAQ
Why Are There So Many Data Breaches in Japan in 2026?
Disclosed compromises of Japanese web systems rose to 119 by October 6, 2026, up from 84 in all of 2025, with most of them after July. Researchers point to indiscriminate, low-cost probing of any site holding personal data, long-neglected web apps, supplier and SaaS compromises that hit many clients at once, and companies discovering breaches after checking their own systems. A security firm has since tied part of the activity to a Chinese-developed AI attack tool.
Which Japanese Companies Were Breached in October 2026?
Disclosures since late September include Times Car, Yakiniku King, Daiwa Securities, Daiichikosho, Lawson, skyticket, Bookoff, JR East, Ride On Express, Sourcenext, Burger King Japan, Yamato Transport, Nikkei and Ymirlink. IDC Frontier, a SoftBank cloud subsidiary, was hit by ransomware that affected 495 customer organizations.
Did Japan Declare a Cyber State of Emergency?
No. The “cyberspace emergency” phrase came from LDP cybersecurity headquarters chair Masaaki Taira at a party meeting on October 9. The government responded with advisories from the National Cybersecurity Office, the Financial Services Agency and other bodies.
Is AI Behind the Japan Cyberattacks?
Partly, according to one security firm. On October 19, GMO Cybersecurity by IERAE confirmed that attack infrastructure targeting about 20 Japanese companies used ARTEX, a Chinese-developed AI penetration-testing tool, and that eight of those companies had disclosed breaches. It has not named the victims or an actor, and the weaknesses exploited, such as exposed web apps and APIs, existed before the tool.
Which Ransomware Groups Target Japan Most in 2026?
The Gentlemen lead with 22 Japanese victims posted on leak sites in 2026, followed by Qilin (14), Everest (9) and Safepay (7). The Gentlemen’s operators previously worked as a Qilin affiliate crew and select victims primarily by FortiGate configuration.
Has the Stolen Japanese Data Been Sold on the Dark Web?
Large-scale sales of the newly stolen data have not been confirmed. Researchers tracking the web compromises report no confirmed bulk sales so far, and most breached companies report no secondary damage, though GMO Research reported 611 fraudulent point exchanges.
