Japan says it is taking corporate cyberattacks seriously as breaches mount
Version 2: The government has now responded, with a senior official saying it takes the attacks seriously and will seek to establish the full picture, while TBS reported that a core member of the international hacking group Qilin was detained in Japan; new details also emerged on a GMO group survey site breach with fraudulent point use, and on Citizen Watch and GMO Research as affected companies.
In short
Japan's government said on Oct 7 it takes the wave of cyberattacks on private companies “very seriously” and will work to grasp the full picture of the damage, without saying whether new active-defence powers had been used. Daiwa Securities, Osaka Metropolitan University and restaurant operator Monogatari Corporation are among those reporting possible data leaks, and TBS reported that a core member of the international hacking group Qilin had been detained in Japan.
Read the full story 3 min read
Japan's government said on Oct 7 that it takes the wave of cyberattacks on private companies “very seriously”. Chief Cabinet Deputy Secretary Yusuke Nakanishi told a press conference that the government will work to grasp the full picture of the damage through analysis of attack methods and trends, Nikkei reported. He did not disclose whether “harmless measures” by police or the Self-Defence Forces had been carried out under the Active Cyber Defense Law that took effect in October. [ 6 ]
Daiwa Securities said on Oct 5 that a server at its outsourcing contractor had been illegally accessed and that about 220,000 items of information, including names, email addresses and account numbers for roughly 110,000 customers, may have leaked. The contractor, Scala Communications of Tokyo, which handles internet inquiries, was accessed on Oct 2 and 3, the company said. Daiwa said no secondary damage such as fraudulent transactions had been confirmed, and that the possibly leaked information cannot be used to access securities accounts or to trade. [ 1 , 2 , 4 ]
Osaka Metropolitan University said on Oct 5 that a ransomware attack is the suspected cause of a large-scale system failure found early on Oct 2, and that the failure was still affecting most of its systems as of Oct 5 with no recovery estimate. The university said data had been tampered with and that personal information on more than 130,000 students, alumni and staff — names, addresses and photographs on student ID cards, as well as bank account details used for staff salary transfers — may have leaked. It said it was consulting Osaka prefectural police and had reported the matter to the national personal information protection commission. [ 1 ]
Other companies reported breaches in the same period. Monogatari Corporation, which operates the Yakiniku King restaurant chain, said its app member management system was illegally accessed and 10,788,963 records leaked — nearly all of the roughly 10.8 million registered members — including names, email addresses and phone numbers, but not login passwords, birth dates, gender or postcodes, and no misuse of the data had been confirmed. A survey site run by a GMO Internet Group company was also accessed, with up to 948,498 records leaked; 611 cases were confirmed in which points worth 2,869,500 yen were exchanged for shopping vouchers, and the points will be fully compensated. Times Car reported that about 1.6 million identity documents, including driver's licence images, leaked, and a class-action sign-up site drew more than 37,000 registrations in six days. Nikkei said employee accounts were attacked and about 9,000 emails impersonating staff were sent, and Nippon TV News reported that a discount store mainly operating in Kyushu had also disclosed a partial leak. [ 2 , 4 ]
TBS NEWS DIG reported that a core member of the international hacking group Qilin had been detained in Japan, and said that nearly 15 million items of personal information may have leaked this month alone at GMO Research, Citizen Watch and Daiwa Securities. The summary states that the outlet sought to establish whether the detained member was involved in the leaks. [ 5 ]
Yutaka Sejiyama, who analyses cyberattack trends at Macnica's security research centre, told Livedoor News that this wave of attacks was short in duration and broad in scope, so AI may be carrying out the work, and that unlike earlier ransomware attacks that demanded money, the purpose is unclear. He said attacks of this scale have not occurred overseas and Japan may be the target, and that attackers are adopting AI faster than corporate defences are improving. The programme It! counted 11 cyber incidents between Sept 25 and Oct 4, including at Keio Electric Railway, Tokyo Metro, Yamato Transport and Sagawa Express, and members of the public interviewed by Livedoor News described suspected fraud calls and card misuse. [ 2 ]
Mynavi News published an analysis piece that did not report the specific incidents, arguing that cybersecurity is now a geopolitical and economic-security issue: attacks cross borders easily, states may target critical infrastructure, and companies depend on supply chains and digital services that can become entry points. It added that not every attack is tied to state rivalry, with ransomware by criminal groups remaining common. [ 3 ]
Why it matters
The reported incidents span finance, food service, car sharing, transport, logistics and a university, touching services used in daily life. A researcher quoted by Livedoor News said AI may be driving the attacks, that their purpose is unclear and that Japan may be the target, while the government said it is still trying to establish the overall scale. Osaka Metropolitan University said most of its systems were still down with no recovery estimate.
Key facts
- Chief Cabinet Deputy Secretary Yusuke Nakanishi said on Oct 7 that the government “very seriously” views the succession of cyberattacks on private companies and will work to grasp the full picture of the damage through analysis of attack methods and trends. [ 6 ]
- Daiwa Securities said a server at its Tokyo outsourcing contractor Scala Communications was illegally accessed on Oct 2 and 3, and that about 220,000 items of information, including data on roughly 110,000 customers, may have leaked. [ 1 , 2 , 4 ]
- Osaka Metropolitan University said a ransomware attack is the suspected cause of a system failure found early on Oct 2, that most systems were still affected as of Oct 5, and that data on more than 130,000 students, alumni and staff may have leaked. [ 1 ]
- Monogatari Corporation, which runs the Yakiniku King chain, said 10,788,963 records were leaked from its app member management system, nearly all registered members, with names, email addresses and phone numbers affected but not passwords, birth dates, gender or postcodes. [ 2 , 4 ]
- A survey site run by a GMO Internet Group company was illegally accessed, with up to 948,498 records leaked; 611 cases in which points worth 2,869,500 yen were exchanged for shopping vouchers were confirmed, and the points will be fully compensated. [ 4 ]
- Times Car reported that about 1.6 million identity documents, including driver's licence images, leaked, and a website for a class action drew more than 37,000 registrations within six days as of 9:00 on Oct 5. [ 2 , 4 ]
- TBS NEWS DIG reported that a core member of the international hacking group Qilin had been detained in Japan, and that nearly 15 million items of personal information may have leaked this month at GMO Research, Citizen Watch and Daiwa Securities. [ 5 ]
- Yutaka Sejiyama of Macnica's security research centre told Livedoor News the attacks were short and wide-ranging so AI may be doing the work, that their purpose is unclear and that Japan may be the target. [ 2 ]
Confirmed by several sources
Still unclear
- Who carried out the attacks and for what purpose. Livedoor News quotes a researcher saying the purpose is unclear and that Japan may be targeted; no document names an attacker.
- Whether the reported incidents are connected, and whether the detained Qilin member was involved in the leaks. The documents describe the cases separately, and TBS NEWS DIG's summary itself asks whether the member was involved in the leaks.
- Whether personal data actually leaked in each case. Daiwa describes a possible leak that cannot be used to access accounts, and Osaka Metropolitan University says it is still investigating whether data was leaked.
- The full scale of the wave of attacks. Livedoor News reports a count of 11 incidents between Sept 25 and Oct 4 from one broadcaster, and TBS's figure of nearly 15 million records this month is a single-source estimate.
- Whether the government used “harmless measures” under the Active Cyber Defense Law that took effect in October. Nikkei reports that Nakanishi did not disclose whether such measures were carried out.
- Monogatari Corporation reported roughly 10.8 million records leaked from the Yakiniku King app, with no credit card data included. Reported by a single source so far
- Times Car reported that about 1.6 million identity documents, including driver's licence images, had leaked. Reported by a single source so far
- The Japanese government, through Chief Cabinet Deputy Secretary Yusuke Nakanishi, said it takes the attacks seriously and is working to grasp the full picture, according to Nikkei. Reported by a single source so far
What local media are saying
Timeline, local time
- Osaka Metropolitan University's system failure is identified and data tampering is found. [ 1 ]
- Scala Communications, a Tokyo contractor used by Daiwa Securities, is illegally accessed. [ 1 ]
- Nikkei says employee accounts were attacked and about 9,000 emails impersonating staff were sent to internal and business contacts. [ 2 ]
- Registrations on a site for a class action over the Times Car leak reach more than 37,000 within six days of its launch. [ 2 ]
- Daiwa Securities, Osaka Metropolitan University and Monogatari Corporation announce breaches and possible data leaks. [ 1 , 2 ]
- Yomiuri Shimbun, Livedoor News, Mynavi News and Nippon TV News publish reports on the attacks. [ 1 , 2 , 3 , 4 ]
- TBS NEWS DIG reports that a core member of the hacking group Qilin was detained in Japan. [ 5 ]
- Chief Cabinet Deputy Secretary Yusuke Nakanishi tells a press conference the government takes the attacks seriously and will work to grasp the full picture. [ 6 ]