From August to late October 2026, disclosures of information leaks surged among companies and public institutions in Japan. The number of disclosed incidents reached 335 in 50 days, with many involving vulnerability exploitation and the unauthorized use of credentials. An analysis of these incidents identified five intrusion methods and five defensive measures to be implemented.
From August to late October 2026, companies, public institutions and cloud services in Japan made a succession of disclosures concerning unauthorized access and personal information leaks, reaching 335 incidents in approximately 50 days. The situation prompted specialized organizations to issue emergency warnings, and analysis is under way into the sources and methods of the attacks.
Of the 24 disclosed incidents, 18 involved the exploitation of vulnerabilities in software or web systems, while 6 involved unauthorized logins using credentials. Analysts say the time between the disclosure of a vulnerability and the start of an attack is shrinking, and that attacks are rapidly becoming more structured and large-scale.
The analysis found that intrusion routes can be classified into five patterns. The first exploits weaknesses in smartphone app analysis and insufficient checks of backend systems, with multiple incidents involving the direct extraction of member information. The second exploits unpatched vulnerabilities in public-facing servers and SaaS, resulting in data leakage in some cases. The third involves exploiting weaknesses in perimeter devices and VPNs to gain unauthorized access to internal networks, with such cases reported. The fourth is a supply-chain attack via business partners, with incidents confirmed involving infections on contractor devices and the theft of credentials from shared services. The fifth involves secondary exploitation through the compromise of administrative functions and lateral movement within the cloud, including a case in which attackers breached a publicly accessible management interface and stole backups.
Specific examples include a large-scale leak at a software company and customer data leaks from multiple services. Reported representative cases include the bulk extraction of member information and incidents suspected of involving external transfer and reuse.