If you follow security news in Japan, you have noticed it: since September 2026, a new data-leak notice has appeared almost every week. Loyalty programs, restaurant apps, booking sites, community platforms and job portals have published notices one after another — several of them already covered here, such as Lawson ID, Bookoff, Commune and Baitoru.
On October 8–9, the country's official security bodies responded together. JPCERT/CC published alert JPCERT-AT-2026-0030, IPA (Information-technology Promotion Agency) released a list of checks to do "immediately", and METI (Ministry of Economy, Trade and Industry) sent a formal request to business associations. This article summarizes what those documents say, in practical terms, for people who run systems at small and mid-sized companies.
One important caveat first: none of these bodies has attributed any specific company's breach to a specific attack method. The cases above are only context for the wave — we are not saying any of them happened the way described below.
What JPCERT/CC said
Alert AT-2026-0030 was published on October 8 and updated on October 9, 2026. JPCERT/CC says that around September there was a series of personal-data leaks caused by unauthorized access at Japanese organizations, and that the technical information shared so far is "limited and fragmentary". It decided to warn anyway because the damage was spreading.
Two points stand out:
- The alert covers a different type of attack from the ransomware cases that happen sporadically all the time: the focus here is intrusions that lead to leaks of large volumes of personal data.
- It is not only public-facing apps. BI (business intelligence) tools and employee management systems were also hit — systems their operators assume are "not exposed to just anyone".
JPCERT/CC stresses that not every incident used the same method and that the page will be updated as new information emerges.
The four attack patterns observed
The alert describes four "cases" based on reports it received. We summarize them at a defensive level, without operational detail:
- Case A — scanning for known vulnerabilities. Not a single flaw in one product. Attackers test, target by target, many already-known vulnerabilities as well as misconfigurations, such as environment configuration files or backups left in reachable locations.
- Case B — API abuse. Improper requests to app management APIs, with data being altered. Reports include analyzing public smartphone apps to discover endpoints and keys; attacks on internal APIs that should not be reachable from the UI (changing user privileges, creating rogue accounts); probing with malformed authentication tokens; blind NoSQL-injection searches to identify accounts; and using API keys stolen in breaches of other systems.
- Case C — Metabase CVE-2026-72898. The SQL injection vulnerability in the Metabase BI tool, also exploited via API, which JPCERT/CC had already warned about on August 14. We covered it in Metabase CVE-2026-72898.
- Case D — web shell on an application server. WAR files were found deployed on application servers reachable from the public web server; the JSP inside worked as a simple web shell.
JPCERT/CC also published suspicious source IP addresses and example User-Agent strings to help investigations, noting that some IPs may be in legitimate use today. If you need to check your logs, use the list directly on the official page (linked in the sources) — it may be updated.
Recommended measures for APIs
The most useful part of the alert is its countermeasure list. For API access, JPCERT/CC recommends:
- Limit the number of requests per unit of time and block repeated access or mass execution.
- Set specific limits for high-risk functions: login, password reset, SMS sending and search.
- Enforce access control on every endpoint, including non-public APIs, accepting only authorized users and HTTP methods.
- Give users and API tokens only the minimum permissions needed.
- Set appropriate expiry for tokens and avoid long-lived tokens.
- Be able to quickly revoke tokens that are no longer used or may have leaked.
Complementary general measures: restrict source regions when the service is used in only one country; apply updates for vulnerable versions; review containment of lateral movement after a web server is compromised; review detection and initial response; brief customers in advance (for example, on multi-factor authentication); take unnecessary admin functions off the internet; and do not keep data past its legal retention period or after its purpose ends. The reference given is the OWASP API Security Top 10.
IPA's immediate checklist
On October 9, IPA published a document addressed to executives of companies that hold large amounts of data. According to the agency, leak notices are coming from a wide range of sectors, including financial institutions and telecom operators, and it is not yet possible to say the attacks target a specific product vulnerability. Based on the pattern of public cases, the starting point appears to be the compromise of externally exposed applications and services, and of accounts.
The checks IPA asks companies to do now:
- Externally exposed applications: list every in-house app and service published on the internet; check recent logs for anomalies (error volume, deviation from normal), starting with the last month and widening to three months; check for pending patches and apply them as soon as possible.
- External services the company uses: list all of them — cloud, VPN and others — including those contracted by individual departments; review each service's logs (failed logins, unusual source IPs and access times); and look for accounts nobody created or disabled accounts that became active again.
- Stored data: review what the company really needs to keep, because data stolen today turns into extortion and forum sales.
If any abnormal log or account shows up, IPA says to treat it as a security incident immediately and strongly recommends bringing in a specialist firm to investigate.
After that, the agency lists medium-term measures: review what is exposed, strengthen authentication (MFA and passwords), review permissions and API integrations, expand log content and retention, and reconsider where and how data is stored, including encryption.
METI's request
METI passed the alerts from the NCO (National Cybersecurity Office), JPCERT/CC and the Personal Information Protection Commission (PPC) to business associations such as JADMA (the Japan Direct Marketing Association) and the Japan Chamber of Commerce and Industry. The ministry asks for three things: direct leadership from top management, fast follow-up on vulnerability information and a move to "zero trust", taking the whole supply chain into account. If an incident occurs, companies in supervised sectors should report it to the ministry with a timeline, type of damage and type of attack, and also consider notifying the police.
What an SMB should do this week
Translating the documents into a realistic routine:
- Take inventory. List everything on the internet under the company's name: website, online store, app, admin panel, BI tool, VPN and cloud services contracted by each team.
- Look at the last 30 days of logs. Look for error spikes, logins from countries where you don't operate, unusually high API call volumes and new accounts nobody recognizes.
- Close what does not need to be open. Admin panels and internal tools should not answer any IP on the internet.
- Review API keys. Revoke old ones, reduce permissions and make sure no key is embedded in a published app.
- Update. Prioritize exposed components and, if you use Metabase, confirm you are on the fixed version.
- Delete what you don't need to keep. Less data, less damage.
For small companies, IPA points out free resources such as the five-minute self-assessment and the SECURITY ACTION self-declaration, plus the "Cybersecurity Otasuketai" service, which bundles monitoring, on-site response and insurance.
What is still unknown
The agencies have not linked the incidents to a single group or a single flaw, and JPCERT/CC itself says its picture is partial. We will follow new updates to AT-2026-0030 and to notices from affected companies, and update this article if anything significant changes.
Sources
- JPCERT/CC: 直近で相次いでいる国内組織における不正アクセスに関する注意喚起 (JPCERT-AT-2026-0030)
- IPA: 不正アクセスによる漏えい等の事案を踏まえ、速やかに実施すべき対策等について (2026-10-09)
- JADMA: 経済産業省の注意喚起及び情報提供に係る協力依頼 (2026-10-09)
- 日本商工会議所: 不正アクセスによる情報漏えい等の事案を踏まえたセキュリティ対策の徹底について（経済産業省）
- JPCERT/CC: MetabaseのSQLインジェクションの脆弱性（CVE-2026-72898）に関する注意喚起
- Impress Watch: 国内で情報漏えい被害が相次ぐ JPCERT/CCが攻撃手法と対策を公表
- マイナビ TECH+: 国内で不正アクセス相次ぐ、JPCERT/CCが注意喚起
- Macnica セキュリティ研究センター: 相次ぐWEBシステムからの情報漏洩事案について
- OWASP API Security Top 10 (2023)
Want this for your business?
KGA IT helps small and medium-sized businesses set up AI assistants, automation and websites. The consultation is free and we reply within 24 hours. Plans start at ¥5,000/month.
- Phone: 080-9732-1062
- Email: kga-it@outlook.com
- Contact page: kga-it.com/en/contact