Japan hit by wave of cyberattacks: data of millions of customers at risk

Japan has faced a massive wave of cyberattacks that affected more than 20 major companies, as well as government agencies and infrastructure facilities. Local media estimate that the total number of records with personal data whose leak is confirmed or not excluded exceeded 50 million. In response to the incidents, Japan's financial regulator has urged banks to urgently strengthen customer identification procedures.

This is reported by the Financial Times and the Japanese outlet FNN, citing data from affected companies and government bodies.

According to FNN's estimates, as of the evening of October 9, the total volume of confirmed and possible leaks reached approximately 52 million records. This does not mean that the data of all these people has already been stolen: some companies are still assessing the extent of unauthorized access. Moreover, one person may be registered in several affected services.

Among the largest incidents is an attack on the car-sharing service Times Car. The company confirmed a leak of information on approximately 6.6 million accounts. Of particular concern is that attackers obtained copies of driver's licenses and other identity verification documents for about 1.6 million customer accounts.

Japanese experts warn that such documents could be used for fraud, including attempts to open accounts or obtain financial services under someone else's name. Times Car stated that it is notifying affected users and conducting an additional investigation.

Other major leaks affected Japanese trading and service companies. The Lawson convenience store chain reported a leak of more than 2.15 million user records from its loyalty program. The bookstore chain BookOff warned about the possible exposure of up to 6.43 million records, and the karaoke venue operator Big Echo about the risk of information leakage for more than 8.7 million customers and employees.

A separate incident occurred at the cloud provider IDC Frontier, a subsidiary of SoftBank. As a result of a ransomware attack, infrastructure used by 495 companies and government organizations was affected. Some clients experienced disruptions in their digital services.

Among the companies that reported possible consequences of this attack is the country's largest railway operator JR East. At risk are approximately 1.67 million email addresses of users of the Ekinet ticket reservation service, as well as data of participants in other company programs. The subsidiary View Card separately reported a risk of leakage of more than 4 million customer email addresses. In total, the JR East group warned about the possible exposure of more than 6 million records.

The scale of the cyberattacks has forced Japanese authorities to take additional measures. On October 9, Japan's Financial Services Agency (FSA) instructed banks and other financial institutions to review their cyber defense systems and strengthen controls during remote customer identification.

The regulator recommended moving as soon as possible from checking document photos to reading information from embedded electronic chips. This approach is intended to reduce the risk of using stolen copies of IDs to open accounts.

It is important that this is not a complete ban on using driver's licenses as identification documents. Japan is changing the way their authenticity is verified. From April 1, 2027, receiving only an image of the document for remote identity verification is to be abolished, but banks have been urged to implement more secure methods earlier.

The head of Japan's National Cyber Security Strategy Headquarters, Masaaki Taira, described the situation in cyberspace as extraordinary. The ruling Liberal Democratic Party held an emergency meeting dedicated to the protection of digital infrastructure.

Experts also point to the possible use of artificial intelligence to accelerate vulnerability discovery and automate cyberattacks. According to them, new technologies lower the technical barrier for attackers and allow targeting a larger number of companies. However, there is currently no evidence that all recent incidents in Japan are connected to each other or carried out using AI.

Based on materials from: Financial Times, FNN Prime Online, Financial Services Agency of Japan