A succession of large-scale data breaches in Japan has highlighted the reality that companies are not properly verifying their contractors' security measures, prompting warnings from experts.
Masatoshi Terada (寺田 真敏), a professor at Tokyo Denki University, points to a gap between the assumptions companies make when overestimating their contractors' security measures and the reality behind the data breaches. In addition to the leakage of account information belonging to approximately 6.6 million Times Car members, a ransomware attack on IDC Frontier reportedly affected approximately 495 companies and municipalities. NEC announced that credentials belonging to a contractor had been stolen and that unauthorised access had occurred to the systems of multiple customers.
Nagoya Bank announced that customer names and email addresses may have been leaked through a contractor operating the email distribution system for its corporate pension services. It has also been suggested that unauthorised access at a contractor of Daiwa Securities may have resulted in the leakage of customer information belonging to Iwate Bank. The Cabinet Cybersecurity Office is calling for continuous verification of contractors' security management practices, on the grounds that information can be leaked in such incidents even when customers bear no significant fault.
Risks at the operational level, including applications, include data leaks from consumer-facing apps and the fact that their code contains information about internal structures that would not be exposed in the same way on websites. While advances in AI are accelerating vulnerability discovery, conventional attack methods are also resurfacing, and there are concerns about the spread of disinformation using AI and targeted scams. Experts are calling for stronger systems on both the defence and attack sides.