Unauthorized access to corporate websites and apps has surged since late September, with a series of personal information leaks. NICT has analyzed the new “A2B attack” method, and countermeasures are gradually being implemented.
Unauthorized access to websites and apps has continued since late September, and the scale of information leaks is growing. According to a Trend Micro survey, the number of affected incidents disclosed in 2026 has reached 600, putting the year on pace for a record high. In the Times Car leak, identity verification documents were reportedly included in approximately 1.6 million of up to 6.6 million affected records. The incidents include cases involving major companies, highlighting information management challenges across Japanese companies.
Experts cite the evolution of AI, international targeting and the growing number of entry points into internal systems resulting from the advance of digital transformation as causes. There are continued warnings that automated attacks using AI and ransom demands through threats are increasing, and that companies of all sizes are being targeted.
On 13 October, the National Institute of Information and Communications Technology (NICT) analyzed and announced the A2B attack (App-to-Backend Attack) as a new attack method. It targets vulnerabilities in communications between smartphone apps and corporate servers through analysis of the apps. No A2B-related damage has been specifically identified at this point, but cases involving Times Car and Yakiniku King, among others, are considered highly likely to have been affected by the method.
The government and research institutions are moving to contain the situation, including by announcing corporate countermeasures such as restricting access from outside Japan. The situation is expected to continue affecting many companies that provide customer services through smartphones.