Japan faces wave of cyberattacks targeting corporations and government agencies

Japan is experiencing a significant surge in cyberattacks, with multiple organizations reporting unauthorized access and data breaches. A major incident involving the hometown tax portal ‘Furusato Choice,’ operated by Trust Bank, resulted in the leak of approximately 4.45 million pieces of personal information, including names, addresses, phone numbers, hashed passwords, and donation tax deduction estimates.

Other notable victims include Joshin, which suspended services following unauthorized access, and Geo, which halted online orders and services due to system breaches. Financial services have also been impacted; Iwai Cosmo Securities reported that an attack on an external contractor led to unauthorized trading orders in seven accounts. Additionally, Shudo Gakuen reported a potential leak of faculty and partner information.

Security researchers at GMO Cyber Security by Ierae have identified the use of ‘ARTEX,’ an AI-driven autonomous penetration testing tool developed by a Chinese engineer, in attacks targeting roughly 80 Japanese companies. Experts warn that such AI tools allow attackers to automate complex tasks, such as bypassing Web Application Firewalls (WAF) and identifying vulnerabilities more rapidly. The impact has also extended to public sectors, with potential data leaks reported in several prefectural police departments and a Ministry of Land, Infrastructure, Transport and Tourism subsidy program.