As cyberattacks targeting Japanese companies and local governments continue, advances in attack techniques and the existence of a criminal market for stolen personal information have been cited as factors behind the attacks. The ease of creating scam emails with generative AI and the potential to reuse personal information are cited as reasons Japan is particularly targeted.
Cyberattacks targeting Japanese companies and local governments have continued, and the US newspaper The New York Times has pointed to delays in Japan's security measures. The background is said to include not only advances in attack techniques but also criminal organizations' ability to use stolen personal information for fraud, raising the possibility that Japanese personal information itself could become a sought-after commodity.
According to a Proofpoint survey, 69.5% of the new email attacks observed in January 2025 targeted Japan, rising to 80.2% in February. This does not mean that 80% of attacks worldwide were directed at Japan, but the proportion of attacks targeting Japan has remained high.
Attack techniques are also changing, with generative AI making it easier to create scam emails in natural-sounding Japanese. Microsoft addressed approximately 1,400 vulnerabilities this year, a figure on a scale comparable to the number of fixes issued annually in recent years.
Meanwhile, stolen personal information such as names, addresses, telephone numbers and email addresses has value in criminal markets and is exploited for fraud and other crimes. Such markets are believed to exist behind the data breaches seen to date.