Recorded Future Reports 48% Rise in Cyberattack Reports Against Japanese Organizations
Summary
Insikt Group says reported attacks on Japanese organizations rose 48%, from 621 to 918, in Q3 2026. The report describes data exposure and service disruption, discusses possible contributing factors, and recommends stronger patching, API controls and account protections
Key points
- Insikt Group counted 918 reported incidents in Q3 2026, up 48% from 621 in Q2; Trend Micro separately reported that January–September 2026 attacks exceeded its total for all of 2025.
- The report describes incidents across retail, rail, logistics, media, education and software, involving ransomware, stolen cloud credentials and exploited web-facing systems.
- Examples cited include roughly 33 million records leaked from EPARK PeakManager in July and 6.6 million Times Car accounts in September.
- For October, the report says a ransomware incident at IDCFrontier disrupted 495 companies and local governments; it also reports that misuse of Sourcenext's member-information API exposed 22,519,960 customer records.
- JPCERT/CC warned of exploitation of known vulnerabilities and misconfigurations, API attacks, CVE-2026-72898 in Metabase, and web shells in .war and .jsp files.
- The report discusses AI as a possible factor in scanning, attack automation and phishing, but notes uncertainty about its use; Macnica could not confirm AI involvement in the attacks it observed.
- Recommendations include updating legacy systems, hardening internet-facing services, tightening API access, using phishing-resistant MFA, limiting data exposure and testing recovery plans.
Article Details
- Publisher
- Recorded Future (Insikt Group)
- Report Period
- Q3 2026, with incidents continuing into October 2026
- Scope
- Reported cyberattacks affecting organizations in Japan
- Sample Size
- Recorded Future Intelligence Platform incident reports; the article does not describe a comprehensive census.
- Key Statistics
- Recorded Future recorded 918 reports of cyberattacks targeting Japanese organizations in Q3 2026, up 48% from 621 in Q2.
- Trend Micro reported 86 attacks affecting Japan in September 2026 and said January–September 2026 totals exceeded all of 2025.
- The July EPARK PeakManager incident reportedly exposed roughly 33 million records; the September Times Car incident affected 6.6 million accounts.
- The October 13, 2026 Sourcenext breach reportedly compromised 22,519,960 customer records.
- Macnica reported that approximately 68% of 119 personal-information-leak cases disclosed in 2026 were announced since July.
- Recommendations
- Replace or update end-of-life and unpatched systems and software.
- Harden internet-facing systems by patching vulnerabilities, restricting administrative access, enabling logging, and disabling unnecessary services.
- Strengthen API authorization and controls, restrict API key privileges, and limit bulk data retrieval.
- Require phishing-resistant MFA and train staff to recognize phishing messages.
- Limit personal-data retention and export permissions, test protected-backup restoration, and establish manual alternatives for critical services.
MITRE ATT&CK
T1078 · Valid AccountsThe article reports misuse of stolen credentials, including cloud and API credentials, to access organizations and systems.T1190 · Exploit Public-Facing ApplicationThe article describes exploitation of known vulnerabilities in internet-accessible systems, including SQL injection in Metabase.T1505.003 · Web ShellJPCERT/CC warned of web shells deployed in .war and .jsp files on internet-accessible web servers.T1566 · PhishingThe article identifies phishing-enabled account compromise and warns of convincing Japanese-language phishing messages.
CVE
People
Threat Actors
Products
Tools
Countries
JapanNew incident-reporting requirements under Japan’s Active Cyber Defense (ACD) law, effective October 1, may further increase the number of disclosures of incidents affecting Japanese organizations.South KoreaNotably, financial institutions in neighboring South Korea were recently the target of an intrusion campaign leveraging ARTEX, a Chinese open-source AI penetration-testing tool attributed to a group Recorded Future
Industries
Educationfirst is the breadth of the attacks: victim organizations spanned the retail, rail, logistics, media, education, and software industries, and the intrusions involved ransomware, stolen cloud credentials, andlogisticsThe first is the breadth of the attacks: victim organizations spanned the retail, rail, logistics, media, education, and software industries, and the intrusions involved ransomware, stolen cloud credentials, andMediaThe first is the breadth of the attacks: victim organizations spanned the retail, rail, logistics, media, education, and software industries, and the intrusions involved ransomware, stolen cloud credentials, andrailThe first is the breadth of the attacks: victim organizations spanned the retail, rail, logistics, media, education, and software industries, and the intrusions involved ransomware, stolen cloud credentials, andRetailThe first is the breadth of the attacks: victim organizations spanned the retail, rail, logistics, media, education, and software industries, and the intrusions involved ransomware, stolen cloud credentials, andSoftwarepotential contributing factors, including demand for Japanese personal information, legacy systems, software vulnerabilities, weak API controls, and AI’s likely role in lowering technical and language barriers.