“I’d left, but they still had my driver’s license” Japan on high alert as personal data keeps leaking

【Financial News correspondent Seo Hye-jin in Tokyo】 Personal data breaches in Japan are spreading beyond shopping and dining to healthcare and disaster-response networks. A breach at a single contractor affected dozens of client companies and even halted hospital appointment operations. Experts say the use of artificial intelligence (AI) has lowered the cost of attacks, expanding the range of targets to include small businesses. Poor data management by companies that retained information on former members also made the damage worse.
According to the Nikkei and the Yomiuri Shimbun on the 18th, E Store announced on the 16th that the personal information of about 23,356,000 people had been leaked.
On the same day, Yamato Transport disclosed a leak involving about 5.3 million records of customers who used its pay-later service, while the Nikkei reported a leak of about 1.83 million records stored in a cloud for development purposes. The previous day, Sourcenext announced the possibility that up to about 22.52 million records in total had been leaked, while BK Japan, the operator of Burger King in Japan, announced a leak of about 11.18 million records of app members.
The breaches led to service disruptions. On the 15th, Medley announced that patient information from as many as 787 medical institutions may have been leaked. After appointment systems and other services were suspended, disrupting operations at obstetrics and gynecology clinics and other facilities, Medley sent hospitals appointment information in PDF format.
Arcadia, a disaster-prevention email provider, is also investigating the possible leak of at least 3 million email addresses and other information. Concerns were also raised that emergency contact lists for about 13,000 Miyagi Prefecture employees and teachers may have been leaked.

According to the Nikkei, citing figures compiled by Trend Micro, Japan suffered 600 cyberattack incidents from January to September this year, exceeding the total for all of last year. The security industry says the use of AI has accelerated attacks and expanded the range of targets.
An engineer at one affected company said the attacker changed tactics in response to the system’s reactions and moved several times faster than a human. An official at Cyber Security Cloud said the company had observed more than 1,200 attempted attacks over 40 minutes and added, “We had no choice but to conclude they were using AI or something close to it.”
Japan’s cybersecurity incident response organization JPCERT/CC said on the 15th that it had confirmed an attacker used AI to search for vulnerabilities. However, it has not been confirmed whether AI was used in all of the recent incidents.
As AI lowers the cost of attacks, hackers’ criteria for choosing targets have also changed. Tetsutaro Uehara, a professor at Ritsumeikan University, explained, “You can find vulnerabilities without incurring labor costs.” Small systems that had been less frequently targeted because of the cost of analysis are now also exposed to indiscriminate attacks, he said. “The language barrier posed by Japanese is also crumbling because of machine translation,” he noted.
Official apps are no exception. Japan’s National Institute of Information and Communications Technology (NICT) identified a method of attacking servers connected to Android apps using information obtained by analyzing the apps. The attackers exploited APIs, the channels through which apps and servers exchange information.
The fact that many companies rely on the same contractors also made the damage worse. According to the Nikkei, at Commune, a community-management company, an attacker impersonated an administrator to obtain member information. As many as 64 companies, including Mazda and Panasonic, may have been affected; an estimated 307,000 members had been confirmed as affected by the leak by the 13th. Attacks on Studio, a website-creation service, also spread to organizations including the Shizuoka Shimbun and Wakayama Prefecture.

The long-term retention of unnecessary personal information was also a problem. About 6.6 million records of current and former members were leaked from the car-sharing service Times Car. About 1.6 million of those records were images of identity-verification documents alone.
Park24, the operator, retained the images for seven years after members left. A representative of Daiki Suisan said, “We retained data on former members without a clear purpose,” adding, “Our awareness was lax.”
Combining leaked information also increases the risk of further harm. Masaya Takahashi, a senior specialist at Trend Micro, warned that AI could link scattered data to create “more precise personal information” and that it could be exploited in crimes targeting specific individuals.
The Japanese government is moving to strengthen security obligations. According to the Yomiuri, the Ministry of Internal Affairs and Communications will convene an expert panel on the 22nd to discuss requiring telecom operators to identify vulnerabilities promptly and manage and supervise external cloud providers. The government is also considering a system that would allow it to order services to be suspended in the event of a serious data breach. It plans to prepare a report by next summer, with legal amendments in mind.
Masaaki Taira, head of the Liberal Democratic Party’s National Cybersecurity Strategy Headquarters, said, “Cyberspace is in a state of emergency.”
Companies are also changing how they respond. Park24 will delete identity-document images as soon as registration is verified and plans to erase images it already holds by the end of this month. Itochu will allow the department responsible for its systems to suspend services in an emergency based solely on its own judgment.
Yosuke Hasegawa, CTO of Secure Sky Technology, said the “volume and speed” of attacks had increased, but most cases involved the use of already-known vulnerabilities. Professor Uehara also warned, “The most dangerous systems are those that appear to be running without problems even though they have not been maintained for a long time.”

[email protected] Seo Hye-jin Reporter