Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Japanese organizations disclosed a cluster of unauthorized-access incidents involving possible personal-data leaks around September 2026, and the government has since called for heightened vigilance and security checks. The public record does not yet show one coordinated campaign. The largest figure in circulation, about 6.6 million member accounts at Times Car, comes from an Associated Press summary rather than from a company disclosure that explains the cause or the data involved. The most detailed official disclosure, from the Digital Agency, describes approximately 246,000 potentially affected records. The idea that AI is lowering hacking barriers is a risk officials are raising. These incidents have not been shown to prove it.
Which organizations were affected and what was exposed
The incidents below are separate events. They differ in cause, scale, and the unit each source uses, so the table reports each one on its own terms.
| Organization or service | Disclosed access route | Scale, in the source’s own unit | Data involved | Exposure status |
|---|---|---|---|---|
| Government Solution Services (GSS), Digital Agency | The agency detected access to many files using a maintenance operator’s account on June 25, 2026. On July 9 it determined that a third party had entered by exploiting a vulnerability in a VPN network device. | About 246,000 potentially affected records: about 189,000 relating to personnel of GSS-using agencies and people who had worked on their business, and about 57,000 relating to businesses and individuals involved in that work. | Names, email addresses, phone numbers, and a smaller number of addresses. Duplicate categories are possible. Excluded: My Number, bank-account information, and pension numbers. The estimate does not cover members of the general public. | Described as possible exposure. Secondary misuse was not confirmed at the time of the September 11, 2026 notice. |
| Business+IT, SB Creative Corporation | Exploitation of a vulnerability in part of the service’s systems, which the company said may have allowed unauthorized acquisition of records (September 14, 2026 follow-up). | 1,137 records concerning 1,132 business contacts. | Names, company names, email addresses, and telephone numbers. The company said member information, passwords, credit-card and other payment information, and lead data were not leaked. | Described by the company as possible acquisition (“may have allowed”). |
| Times Car | Not stated in AP’s October 9, 2026 summary. | About 6.6 million member accounts, per AP. AP describes the attack as having taken place the previous month. | Not stated in AP’s summary. | Described by AP as exposure. Company-level confirmation is not stated in AP’s summary. |
| Lawson, Daiwa Securities, BookOff | Not stated in AP’s summary. | Not stated. | Customer-data leaks reported, per AP. | Not stated. |
How to read the numbers
There is no verified total for September. Three different units appear in the reporting, and each means something different:
- Records are database entries, and one person can appear more than once. SB Creative’s 1,137 records concern 1,132 business contacts. The Digital Agency’s roughly 246,000 figure is the sum of two categories, and duplicates are possible between them.
- Accounts are member logins or profiles. AP’s 6.6 million figure for Times Car counts accounts; it does not say how many distinct people those accounts represent.
- Potential versus confirmed. The Digital Agency’s figure estimates potentially affected records. Wording such as “may” or “possible” should not be read as a confirmed count.
Adding these figures together would produce a number that no source reports.
#1 Best Overall
How the affected organizations responded
Both disclosures describe fixes and account-level measures. Each measure applies only to the incident it is listed under.
| Measure | Digital Agency (GSS) | SB Creative (Business+IT) |
|---|---|---|
| Vulnerability fix | Applied a patch to the VPN network device. | Fixed the vulnerability in the affected part of the systems. |
| Account action | Suspended the affected account. | Added password resets and one-time-password authentication for the relevant accounts. |
| Containment of connections | Cut off external communications from the compromised device. | Reviewed web application firewall (WAF) settings and external access controls. |
| Review and assessment | Said it would review vulnerability management and improve external connection methods. | Reviewed related functions and commissioned an external vulnerability assessment. |
| Public disclosure | Published September 11, 2026. | Published a follow-up on investigation results and recurrence-prevention measures on September 14, 2026. |
Neither disclosure says the same weakness caused any other breach.
What JPCERT/CC is warning about
JPCERT/CC’s alert, published October 8 and updated October 9, 2026, focuses on a potentially increasing type of attack that results in large personal-information leaks. It treats these as distinct from the sporadic ransomware incidents that continue to occur. The technical information it has received is limited and fragmented, and it cautions that the methods it describes do not mean every incident used the same one.
Free tools Windows power users keep installed
One-click scans. No signup required.
The patterns it describes are:
- Scanning for known vulnerabilities across different software products.
- Attempts involving configuration or backup files.
- Unauthorized administrative API requests.
- A web shell on an application server that a public web server can reach. JPCERT/CC describes this case as newly identified in its alert.
Security checks organizations can run now
The following checks follow from the incidents above and from JPCERT/CC’s alert. They are recommendations drawn from that evidence, not a standard published by either body.
Rank #3
- Business-intelligence and employee-management systems. JPCERT/CC says organizations should include systems not designed for access by an unspecified number of users. Internal information in such systems can be exposed, so add them to your review of what is reachable from outside.
- VPN and network devices. Confirm that vendor patches are applied. The Digital Agency’s immediate response included a VPN patch.
- Maintenance and vendor accounts. The Digital Agency detected its incident through access made with a maintenance operator’s account. Review which vendor accounts exist, and suspend any that are no longer needed.
- Authentication. Require strong passwords and one-time passwords for sensitive accounts, as SB Creative did for the relevant accounts.
- Configuration and backup files. Confirm that these files are not reachable from the internet.
- Administrative APIs and web shells. Review logs for unauthorized administrative API requests, and inspect application servers that public web servers can reach for web shells.
- Known vulnerabilities in every product. Inventory software versions across all products, not only the main ones, and patch known vulnerabilities.
- Supply-chain partners. Government guidance calls for strengthened cybersecurity across supply chains. Include vendors that hold your data or access your systems.
- Contact-data phishing. Leaked names, email addresses, and phone numbers can support phishing and impersonation. Verify unexpected requests through a channel you already use.
What officials asked for
On October 9, 2026, Japan’s government called for increased vigilance, according to AP. The instructions included keeping security protection updated, using strong passwords, and strengthening cybersecurity across supply chains. AP also reported a government warning that attackers had impersonated people claiming to guard against cyberattacks, so treat unsolicited offers of security help with caution.
AP attributes two statements to Toshiharu Furukawa, Japan’s Minister for Digital Transformation, made to reporters during the week of the October 9 report: “The attacks are getting increasingly sophisticated,” and “Everyone must become vigilant about protecting your own information yourself.” These are AP’s English renderings, not a verified transcript of the original Japanese.
The call is for checks. It is not evidence that every organization that received it was breached.
Did AI make these attacks possible?
The headline’s AI clause is the least-supported part of the story. The available sources establish a narrower point: AI is a recognized and growing security concern, but they do not connect it to the named September incidents.
Best Value
| Claim | What the sources show |
|---|---|
| AI was used in the Digital Agency, SB Creative, or Times Car incidents | Not shown. No available source attributes these incidents to AI. |
| AI caused the September cluster | Not established. |
| AI is making vulnerabilities more complex | Japan’s government warned of this, as reported by AP on October 9, 2026. |
| AI misuse is linked to more sophisticated ransomware and supply-chain attacks | IPA’s September 30, 2026 summary of its 2026 Information Security White Paper describes this association. |
| AI lowers the cost, skill, or time needed for these attacks | No available source quantifies this for these incidents or for attacks in general. |
IPA’s summary also describes national policy built around AI safety, responding to cyberattacks that misuse AI, and using AI to strengthen cybersecurity. Those are policy positions, not findings about who carried out the September incidents.
The longer trend in case counts
AP reports, citing a study released in 2026 by the Yomiuri newspaper and Trend Micro, that more than 500 cyberattack cases have occurred so far in 2026. AP says 2026 was on course to set a record, without stating the period the record would cover. The study’s counts are news-reported figures, not a government census.
| Year | Cases reported |
|---|---|
| 2024 | 503 |
| 2025 | 473 |
| 2026 | More than 500 so far, per the study as reported by AP. The cut-off date is not stated in AP’s report. |
The 2025 count is lower than 2024, so the series does not show a steady climb.
Quick Recap
What remains unresolved
- Whether the September incidents share an attacker or technique. JPCERT/CC’s alert does not establish this, and the methods it lists are patterns rather than a single signature.
- Whether the companies AP named, including Lawson, Daiwa Securities, and BookOff, will disclose causes, record counts, or data fields.
- Whether the contact data exposed in the Digital Agency case is later linked to phishing or impersonation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
