Japan’s October 2026 Breach Surge: Report Examines AI Links and Ransomware Trends
Summary
SOCRadar’s analysis tracks Japan’s October breach surge, supplier exposure and ransomware trends. It reports GMO Cybersecurity’s finding that infrastructure targeting about 20 Japanese companies bore traces of ARTEX; eight targets had disclosed breaches.
Key points
- SOCRadar Dark Web News logged 134 Japan-related items in October 1–15, exceeding September’s full-month total of 129.
- Disclosed compromises of Japanese web systems reached 119 by October 6, 2026, compared with 84 in all of 2025; 81 of the 119 were reported after July 1.
- GMO Cybersecurity by IERAE reported traces of ARTEX, a Chinese-developed AI penetration-testing tool, on infrastructure targeting about 20 Japanese companies. Eight had disclosed breaches; the victims and an actor were not named.
- The article identifies internet-facing web apps and APIs, contractors, and shared platforms as recurring exposure points. IDC Frontier’s ransomware incident affected 495 customer organizations; the company said it had found no evidence of data exfiltration from affected zones.
- SOCRadar’s leak-site data tagged 117 Japan-related ransomware victims from January 1 to October 14. The Gentlemen had 22 posts and Qilin 14; the counts include repeat victims and entries not representing Japanese companies.
- Recommended defenses include auditing web apps and APIs, reviewing supplier access and risk, monitoring unusual data exports, minimizing retention of identity images, and hardening edge devices.
Article Details
- Publisher
- SOCRadar
- Report Period
- 2026-01-01 to 2026-10-19, with a focus on breach disclosures from late September through October
- Scope
- Japanese breach disclosures, ransomware activity, and AI-linked attack infrastructure targeting Japanese organizations
- Sample Size
- 78 Japanese incidents in the public tracker as of 2026-10-15; other datasets use separate populations.
- Key Statistics
- SOCRadar logged 134 Japan-related Dark Web News items from 2026-10-01 to 2026-10-15, compared with 129 for all of September; the daily rate was 8.9 versus 4.3.
- Disclosed compromises of Japanese web systems reached 119 by 2026-10-06, up from 84 in all of 2025; 81 of the 119 occurred after 2026-07-01.
- At least 36 Japanese organizations issued a first breach notice from 2026-09-25 to 2026-10-08.
- IDC Frontier’s ransomware outage affected 495 customer organizations; its 2026-10-14 update said it had found no evidence of data exfiltration from the affected zones.
- GMO Cybersecurity reported that ARTEX traces were found on attack infrastructure targeting about 20 Japanese companies; eight had disclosed breaches. It also identified six additional AI-based attack infrastructures targeting Japanese firms.
- Recommendations
- Audit internet-facing web applications and APIs that hold personal data, including legacy systems and APIs behind public mobile apps.
- Review third-party risk across contractors, SaaS platforms, and hosting providers, including what customer data they hold and how supplier breaches will be reported.
- Monitor for unusual data volumes from member APIs and display functions.
- Patch and review FortiGate configurations and rotate VPN credentials.
- Minimize retention of license and ID images and move identity checks to IC-chip verification.
MITRE ATT&CK
T1078 · Valid AccountsStolen credentials and admin logins were used to access systems, including a development system and a support-staff account.T1190 · Exploit Public-Facing ApplicationThe report describes attackers exploiting software vulnerabilities and server-side flaws in web services and app backends.
CVE
People
Threat Actors
ArmCorpDescribed as a Qilin affiliate crew whose operators later formed The Gentlemen.Dark Storm TeamJoined NoName057(16)’s #OpJapan campaign in August, according to the report.EverestRansomware group with nine Japan-related victim posts in 2026; it posted UNIRITA before the company confirmed publication of its data.NoName057(16)Hacktivist group behind a DDoSia campaign in February in which Japan accounted for 39.4% of the group’s attack entries; the group relaunched #OpJapan in August.QilinRansomware group with 14 Japan-related victim posts in 2026; the National Police Agency says it has hit 53 Japanese organizations since April 2023.SafepayRansomware group with seven Japan-related victim posts in 2026.The GentlemenRansomware group with 22 Japan-related victim posts in 2026; the report says its operators select victims primarily based on FortiGate configuration.
Vendors
CommuneCommune: a breach of this community SaaS exposed members of communities run by Yamaha, Suzuki, Sansan and LINE YahooIDC FrontierCar, Lawson, Yakiniku King, Sourcenext and Burger King Japan, and a ransomware attack on SoftBank’s IDC Frontier cloud took 495 customer organizations offline.Scala CommunicationsWhere entry points were disclosed, internet-facing web services, contractors and shared software led; single suppliers such as IDC Frontier and Scala Communications exposed many organizations at onceStudioStudio: attackers exploited a feature flaw in this website builder’s cloud environment from September 30 to October 1, potentially exposing data for all of its customers and the sites built on it, including sites run byYmirlinknew notices kept arriving after mid-October from Yamato Transport, Nikkei and email delivery provider Ymirlink, among others.
Products
Tools
ARTEXthat targeted about 20 Japanese companies, eight of which have disclosed breaches, carried traces of ARTEX, a Chinese-developed AI penetration-testing toolGentleKillerthe group selects victims primarily by FortiGate (mis)configuration and equips affiliates with the GentleKiller EDR-killer suite, which fits its mostly mid-size Japanese manufacturing victims.
Countries
Industries
E-commerceattack infrastructures aimed at Japanese firms in retail, education, marketing, insurance and finance, e-commerce, media and logistics, and judged that one group may be running country- and industry-specific campaigns.EducationGMO found six more AI-based attack infrastructures aimed at Japanese firms in retail, education, marketing, insurance and finance, e-commerce, media and logistics, and judged that one group may be running country- andfinanceAI-based attack infrastructures aimed at Japanese firms in retail, education, marketing, insurance and finance, e-commerce, media and logistics, and judged that one group may be running country- and industry-specificInsurancefound six more AI-based attack infrastructures aimed at Japanese firms in retail, education, marketing, insurance and finance, e-commerce, media and logistics, and judged that one group may be running country- andlogisticsThe affected organizations span car sharing, restaurants, retail, logistics, media, rail, travel, securities, universities and cloud hosting.Manufacturinga record but only seven more than in H1 2025, with small and mid-size companies accounting for 79 and manufacturing the most affected sector at 37(NPA).marketingGMO found six more AI-based attack infrastructures aimed at Japanese firms in retail, education, marketing, insurance and finance, e-commerce, media and logistics, and judged that one group may be running country- andMediaThe affected organizations span car sharing, restaurants, retail, logistics, media, rail, travel, securities, universities and cloud hosting.RetailThe affected organizations span car sharing, restaurants, retail, logistics, media, rail, travel, securities, universities and cloud hosting.