What happened, how it changes your security posture, and which teams should pay attention. Thoughtful breach analysis in English and Japanese.
38 articles
TrendAI found three attacker servers aimed at Japan, one running CyberStrikeAI with 44 agents. Microsoft ties ARTEX to Storm-0940. What is proved, what is not, and how to detect it.
Where to find how breaches are really done, a dated timeline to 25 October 2026, and a reproducible risk model on 264 Japanese notices: a heavy tail and supplier cascades.
Lawson store in Minamisōma, Fukushima. Archive photo, 2008; it shows a store, not the systems involved.
Photo: Kuha455405, CC BY-SA 3.0, via Wikimedia Commons (cropped)
Names, plus phone numbers, addresses and possibly dates of birth, for 2,155,345 Lawson ID accounts; Lawson corrected on 24 October that email addresses did not leak. What to check.
The 38 largest disclosures of the past 12 months and all 153 notices of the last 60 days, sorted by how the data got out: apps and APIs, analytics tools, suppliers, accounts, ransomware.
Sender and recipient details for about 100 days of parcels may have leaked through a tracking lookup. What that means for your own public lookup services, and for companies that ship with a carrier.
At 21:55 on 21 October, Sanae Takaichi asked website owners to patch PHP that night, or switch their sites off. What PHP2Shell is, how much of Japan it reaches, and what to do now.
What the October phishing report describes, the signing gap behind it, and the checks that matter in Proofpoint Enterprise Email Protection and TAP.
At least ten Japanese companies said data left through their apps, APIs or lookup pages this autumn. How to find every API you run, test it, fix it and watch it, with queries and templates.
Burger King at Aeon Lake Town, Koshigaya, Saitama. Archive photo, 2010; it shows a restaurant, not the systems involved.
Photo: Wiki591801, CC BY 3.0, via Wikimedia Commons (cropped)
BK Japan says its app's member system was accessed from 2 to 7 October. What leaked, what the dates show, and an outside-in risk card for its internet-facing systems, scored without the details.
Photo: Lombroso, CC BY-SA 4.0, via Wikimedia Commons (cropped)
Yamato confirms stolen buyer, recipient and merchant records. What changed on 16 October, what did not leak, and how to verify payment requests.
The company behind the ZERO antivirus range, Fudegurume and Pocketalk says a member API was misused for four days. What leaked, who its customers are, and what they should check.
New daily public-IPv4 scans bring port histories, banners and fingerprints to VirusTotal. See what changed, where to find it and how to pivot to related infrastructure.
Ransomware hit IDCF Cloud on 7 October 2026. The 14 October report: backups for 194 customers, no sign data left their servers, 48 portal records viewed; new notices from Mouse, Izumi, JR Central.
The travel site disclosed three intrusions on 9 October. Four days later NICT warned of “A2B” attacks that start by analysing a company's app. What leaked, how the routes differ, and what to check.
On 8 and 9 October a minister and the ruling party called Japan's wave of breaches critical, even an emergency. What was said, what it does and does not mean, and what our numbers showed first.
Asahi Kasei Therapeutics’ HCP site was breached at its operator. Why specialty-tagged HCP data and MR photos fuel targeted phishing, and what pharma teams should check now.
Passport details and allergy notes for up to 627 travellers may have been taken from an overseas file server. Why scoping took 300 days, and what to check in your own subsidiaries.
Official logo: © Rakuten. Source. Shown to identify the subject of independent reporting.
Files linked to 15,382 accounts were accessed or obtained. Separate profile and password-data exposures show why cloud incidents need both privilege and data-impact reviews.
A night-time system failure led to traces of an intrusion that began at a web-system vulnerability. What the two notices say, what changed between them, and what online retailers should check.
Times CAR car-sharing signage and a vehicle. Archive photo, 2017, showing the former Times Car Plus branding.
Photo: Carauto, CC BY-SA 4.0, via Wikimedia Commons (cropped)
About 6.6 million accounts and identity documents for 1.6 million. Updated with Japanese licence images for sale on a dark-web site and 40,000 lawsuit sign-ups.
Official logo: © Daiwa Securities Co. Ltd.. Source. Shown to identify the subject of independent reporting.
Daiwa’s supplier inquiry-data incident explained: reported scope, unknowns, fraud implications, team actions and scoped KQL/Splunk hunting templates.
Official logo: © GMO Research & AI, Inc.. Source. Shown to identify the subject of independent reporting.
A software vulnerability exposed all 948,498 records of the GMO survey site infoQ, and 611 accounts had points exchanged without consent. What points operators, SOCs and members should check.
Official logo: © THE MONOGATARI CORPORATION. Source. Shown to identify the subject of independent reporting.
Verified scope of the Yakiniku King app breach, impersonation and recovery risks, team actions, decision branches and scoped KQL/Splunk hunting templates.
Official logo: © G-PLAN INC.. Source. Shown to identify the subject of independent reporting.
G Point’s incident explained: identifier scope, outage and point protection, partner reconciliation, team responsibilities and KQL/Splunk review templates.
Official logo: © Osaka Metropolitan University. Source. Shown to identify the subject of independent reporting.
All five campuses lost their systems on 2 October. Data on at least 130,000 students and graduates may have leaked. What a shared virtualisation platform and reachable backups mean for recovery.
Election operations in practice: a polling station in Higashi-Osaka, 2014. Illustrative archive photo; no incident at this location is alleged.
Photo: MASA, CC BY-SA 4.0, via Wikimedia Commons (cropped)
An evidence-led analysis of election security: identity, voter data, suppliers, DDoS, AI impersonation, recovery and scoped KQL/Splunk examples.
A research brief on the 'Big Four' state actors in 2025–26: their mandates, who they hit (Japan is 20% of China-linked targeting in Microsoft's data), and the hunts that follow.
Official logo: © Nikkei Inc.. Source. Shown to identify the subject of independent reporting.
Mail from a real Nikkei account led recipients to a malicious site on 30 September. What recipients should check, and why the stated fix, a password change, is not the whole recovery.
Photo: Harris de Weerd, CC BY-SA 4.0, via Wikimedia Commons (cropped)
CertiK counts 248 incidents and a 54% rise in Q3 2026, but only 10% after returned funds. Bitget's $387.5M theft began with a zero-day in a security product. What security teams should learn.
Photo: Smbd, CC BY-SA 4.0, via Wikimedia Commons (cropped)
1,360,563 member records may have been viewed, and the sales system also stored unhashed server and VPS passwords. What hosting customers should rotate, check and hunt for.
A US rename and a .si registration rush give unvetted AI tools a new name that word-based proxy, DLP and policy controls may not catch.
Hardware security keys illustrate phishing-resistant authentication. The pictured products are not alleged to be compromised.
Photo: Tony Webster, CC BY 2.0, via Wikimedia Commons (cropped)
A China-aligned actor that targets think tanks in the US and Japan relays Microsoft's real sign-in through a fake browser window. What stops it, who acts, and how to hunt for it.
Official logo: © Zammad GmbH. Source. Shown to identify the subject of independent reporting.
A support platform can connect sensitive conversations, privileged workflows, and the rest of the environment.
The Pentagon, photographed in 2018. Context image for the personnel-data report; not a photograph of the affected system.
Photo: Touch Of Light, CC BY-SA 4.0, via Wikimedia Commons (cropped)
A long reported exposure window shifts the review toward retention, historical evidence, data ownership, and targeted impersonation.
Photo: Hiroshi Ishii, CC BY 2.0, via Wikimedia Commons (cropped)
JAEA’s cloud-service disclosure highlights sensitive uploads, supplier evidence, and the limits of an endpoint-only investigation.
Official logo: © Consensys. Source. Shown to identify the subject of independent reporting.
What an infrastructure incident means for service owners, key custody, partner assurance, and follow-on impersonation.
Photo: Coolcaesar, CC BY-SA 3.0, via Wikimedia Commons (cropped)
New post-exploitation reporting offers leads for appliance logs, configuration exposure, and privileged changes.
Photo: Zimbra Inc, CC BY 4.0, via Wikimedia Commons (cropped)
Microsoft’s exploitation report connects a mail-server weakness to host activity and published network indicators.
Try a different search or team.
_03.jpg){kind=link}
.JPG){kind=link}
.jpg){kind=link}
_(42286852310).jpg){kind=link}
