The amended Act on the Protection of Personal Information made reporting and notification mandatory in the event of a data breach, making it more likely that personal data breaches at large companies will be disclosed. As digitalisation and cloud migration advance, the damage is expanding, while the threat of AI hacking is growing.
The reason personal data breaches at large companies have been reported almost daily in recent months is the obligation to report and notify under the amended Act on the Protection of Personal Information, which took effect in April 2022. As a result, more serious breach incidents have been publicly disclosed through official announcements and news reports.
As companies have advanced their digital transformation and migrated to the cloud, data has become more concentrated, increasing the risk that a single intrusion will result in the loss of a large number of records at once. Large companies are also more likely to be targeted in supply chain attacks carried out through external contractors.
The difficulty of disclosing specific attack methods is cited as one factor behind the spread of the damage. There are concerns that publicising the entry route could prompt attackers to launch another attack, and it has been pointed out that this makes it difficult for the industry as a whole to share lessons learned.
In recent years, the language barrier has diminished and the spread of generative AI has improved the naturalness of Japanese, leading to an increase in targeted attacks by overseas hackers. Wave attacks using AI and automated tools, as well as “double extortion”, in which data is encrypted and the stolen data is published at the same time as a ransom demand, have become mainstream.
Leaked data is traded at high prices on the dark web, expanding the secondary harm caused by personal data breaches. Criminal groups are motivated by huge financial gains, and there are cases involving state-backed cyber units.