JPCERT/CC Warns of Rising Web Data Leaks in Japan Linked to API Abuse and Metabase Attacks
Summary
JPCERT/CC says Japanese organizations are seeing a possible rise in personal-data leaks involving mobile API abuse, weak configurations and known flaws, including Metabase's actively exploited CVE-2026-72898.
Key points
- JPCERT/CC says it has received reports of repeated personal-data leaks around September 2026, but describes its information as limited and does not identify affected organizations or a responsible actor.
- The reported attack patterns include abuse of mobile-app management APIs, attempts to exploit varied known flaws or poor system management, and exploitation of Metabase's CVE-2026-72898.
- Macnica counted 119 similar incidents disclosed in Japan through October 6, 2026, compared with 84 in 2025 and 62 in 2024; 81 of this year's cases were disclosed from July onward.
- Park24 reported data from about 6.6 million Times Car accounts obtained and identity documents leaked from about 1.6 million accounts. Monogatari Corporation reported 10,788,963 records leaked from its Yakiniku King app member system.
- CVE-2026-72898 is an unauthenticated, critical SQL injection flaw in Metabase that can enable administrator access and exposure of credentials for connected databases. CISA added it to its Known Exploited Vulnerabilities catalog.
- Metabase fixed the flaw and recommends upgrading to its safe releases; it offers blocking /api/session/reset_password as a temporary measure. Logs showing a specified reset-password request followed by a successful current-user request may indicate compromise.
- JPCERT/CC recommends controls including endpoint access restrictions and disabling unnecessary internet-accessible administrative functions; Macnica advises reviewing logs and avoiding API keys or database credentials embedded in shipped app or browser code.
Article Details
- Event Type
- Personal data leaks linked to mobile-app API abuse and exploitation of known software flaws, including CVE-2026-72898 in Metabase.
- Impact
- Japanese organizations reported large-scale personal data exposure. Park24 said data from about 6.6 million Times Car accounts and identity documents from about 1.6 million accounts had leaked; Monogatari Corporation said 10,788,963 records from the Yakiniku King app member system leaked. Macnica counted 119 similar incidents made public in Japan through October 6, 2026, while noting that many disclosures lacked enough detail to identify the access method.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 210[.]149[.]87[.]120 | Address Macnica lists among those to check in connection with the reported activity; it may be a shared VPN exit, so a request alone does not prove an attack. |
| IPV4 | 69[.]10[.]51[.]162 | Address Macnica lists among those to check in connection with the reported activity; it may be a shared VPN exit, so a request alone does not prove an attack. |
CVE
Products
MetabaseThe only product it names as a target is Metabase, a BI tool with a known flaw that attackers have exploited. Metabase has urged users to upgrade to at least the minimum safe releases in a list last updated August 14.Times CarSeptember 28 that a third party obtained data on about 6.6 million accounts from the web system of its Times Car car-sharing service. A day later, it said that identity documents, such as driver's license images, hadYakiniku King appthe Yakiniku King restaurant chain, said 10,788,963 records leaked from the member system of its Yakiniku King app, INTERNET Watch reported on October 5. Both companies said at the time that the cause was still
Countries
Francein 13 other countries and regions, mostly from July to September, including 30 in South Korea, 11 in France and 8 in Poland. It does not know whether Japan is the only target, and said disclosure laws andJapanthrough October 6 in which personal data was stolen or leaked through web systems run by organizations in Japan. It counted 84 in all of 2025 and 62 in 2024, and 81 of this year's 119 came in July or later.Polandcountries and regions, mostly from July to September, including 30 in South Korea, 11 in France and 8 in Poland. It does not know whether Japan is the only target, and said disclosure laws and practices differ bySouth Korea99 similar cases in 13 other countries and regions, mostly from July to September, including 30 in South Korea, 11 in France and 8 in Poland. It does not know whether Japan is the only target, and said disclosure