The original text is in EN, taken from the source site. Source ↗

Japan is dealing with an intense wave of AI-assisted intrusions that has exposed weaknesses in its corporate and public-sector defenses. Dozens of incidents, from brokerages to delivery firms, have made data leaks routine.

Japan AI cyberattacks

According to reporting published by Bloomberg, on October 28, Japan’s Ministry of Economy, Trade and Industry (METI) disclosed unauthorized access to the website of the Electricity and Gas Transaction Surveillance Commission.

Days earlier, hackers claimed to have published sensitive customer data from GMO Internet Group’s currency trading platform.

GMO also received an extortion demand of roughly ¥8 billion (about $50 million), as previously reported. The company said no ransomware attack had been confirmed as of October 27.

Other incidents include the National Police Agency reporting that data on about 125,000 officers and staff across 20 prefectural forces may be exposed through cloud provider Arcadia.

In addition, Sony Network Communications disclosed 2,585,481 exposed customer records, while ransomware hit SoftBank-owned IDC Frontier on October 8 and disrupted 495 client organizations.

Experts say AI agents and open-source hacking tools make it easier for criminal groups to exploit outdated infrastructure and get past the Japanese language barrier.

Attackers use AI to analyze networks, find vulnerable targets and evade detection. They also use it to automate vulnerability scanning and write phishing campaigns.

GMO Cybersecurity by Ierae has linked a China-developed testing tool called ARTEX to several recent attacks. Separate research on exposed attacker infrastructure found abuse of the open-source AI-agent platform CyberStrikeAI.

It also found human-directed intrusions that used AI for planning and tool development, as covered in this analysis of AI-powered attacks on Japanese firms.

Critical PHP vulnerabilities disclosed recently triggered millions of hacking attempts and took government and company sites offline in Japan and Europe.

TrendAI counted 723 incidents in the year to October 20, more than the full-year totals for 2024 and 2025.

Chief Cabinet Secretary Minoru Kihara said personal data on about 260 million people has been compromised since April. Reported leak cases jumped from 303 in September to 830 in October.

Macnica reports that suspected website and app breaches rose from a monthly average of six in the first half of the year to 23 per month since July. Small, cash-rich firms with weak IT security remain especially attractive targets.

Prime Minister Sanae Takaichi has promised an emergency cybersecurity package. METI also plans an AI-driven “white hat” team inside the Information-technology Promotion Agency (IPA), starting in November, to run simulated attacks and find weaknesses. Japan activated its Active Cyber Defence framework on October 1.

Defenders should patch PHP and other internet-facing software immediately and audit public websites and apps for exposed entry points.

Organizations must also harden cloud and desktop services, enforce multi-factor authentication, and monitor environments for AI-driven scanning and mass credential testing.

Finally, enterprises should prepare robust incident response and breach-notification plans to minimize disruption when incidents occur.