AI Autopsy: Deluge of Japanese Data Breaches Puts the Spotlight on API Security

First came a trickle, then a flood. Japan has experienced an unprecedented wave of cyber-attacks this year, affecting millions of consumers. Big-name brands including Burger King (11 million), car rental company Times Car (6.6 million) and restaurant chain Yakiniku King (11 million) have been hit  The deluge has highlighted the country’s relatively poor track record on cybersecurity and lack of coordinated response at a government and law enforcement level.

But less well publicised is the fact that many of these attacks have been targeted at public-facing and internal web systems. One local IT specialist, Macnica, has tallied 119 such cases this year alone (up to October 6). That compares with just 84 last year and 62 in 2024.

Whether the same group is behind them all is less important than the techniques being used to steal data on a massive scale. The lesson for CISOs is clear: ignore API security at your peril.

A cyber tsunami arrives

None of the cases recorded by Macnica involved techniques such as phishing or credential stuffing. No ransomware attacks were counted. These are all successful breaches of personal information (PII) at Japanese companies targeted via their websites and apps. No web-based service is too obscure. Where once, hackers aimed for e-commerce sites, now they’re going after various systems, the report noted.

“Attackers are trying any web system that holds personal data” Randolph Barr

“Recent striking examples of such attacks include library catalogue searches, tourist train seat reservations, university seminar house facility reservations, and concert ticket refund management,” wrote Macnica’s Toyo Sejiyama. “Even systems that were previously considered less likely targets have experienced or are at risk of data breaches. The affected industries and website sizes vary widely.”

Japan’s national computer emergency response team (JPCERT/CC) has highlighted a similar trend. In a recent alert, it explained that, as well targeting apps for general users, hackers are aiming at systems not designed for popular use – “such as business intelligence tools and employee management systems”.

Randolph Barr, CISO at API security specialist Cequence Security, warns that attackers don’t rank targets the same way as defenders.

“Organisations protect their flagship website and treat the member portal, the BI dashboard, or the admin console as low priority. Attackers see each of those as another door into the same customer data, and several of these incidents started in systems their owners didn’t think of as public at all,” he tells Assured Intelligence.

“Attackers are trying any web system that holds personal data, whoever runs it. So, the lesson for CISOs is that obscurity has stopped being a control. If an app touches sensitive data and can be reached from the internet, it needs the same scrutiny as your most visible product.”

Focus on APIs

Security researchers have observed various techniques in the recent spate of attacks against Japanese firms. In some, threat actors are simply scanning for known software vulnerabilities in common tools, such as an SQL injection flaw (CVE-2026-72898) in open source analytics offering Metabase, JPCERT/CC said. Macnica also points to the use of passwords obtained via infostealers and the compromise of weak credentials through password guessing to gain admin-level privileges. However, the most noteworthy trend is that of targeting the API attack surface.

“A zero-secrets architecture is imperative for mobile API security” Mark Mazur

Based on reports they’ve received, JPCERT/CC and Macnica revealed three patterns. Attackers are analysing publicly available smartphone applications to identify API endpoints and extract keys, calling those APIs in a way that appears legitimate. They are also using API keys stolen from other compromised systems. And they are targeting internal APIs that cannot be used through the app’s screen. They might do this to change user privileges, create unauthorised accounts, or identify account details through blind NoSQL injection, among other things, JPCERT/CC said.

Hackers also benefit from flaws in these application interfaces such as APIs that return more data than necessary, those with excessive privileges, member functions that are accessible to anonymous users, logic errors, and session management faults, explained Macnica.

“Hidden [API] endpoints are often where access controls are thinnest, because the team assumed nobody would find them. CISOs need an inventory built from real traffic and not just from documentation, because the spec rarely matches what’s running,” says Barr. “Every endpoint should enforce authorisation on its own, without relying on the app to hide it. Teams should also check whether APIs return more data than the caller needs, since over-sharing responses turned an ordinary request into a bulk export in more than one of these cases.”

Mark Mazur, field CTO of API security vendor Approov, adds that teams should also remove secret API keys and database credentials so they’re never built into a shipped app or browser code.

“A secret shipped to a device you can’t control is a published secret on a delay. A zero-secrets architecture is imperative for mobile API security in the agentic era,” he tells Assured Intelligence.

Security leaders should take particular care to protect non-public-facing apps and APIs, argues SANS Institute certified instructor, Rich Greene.

“Organisations should limit access to these systems, enforce least privilege and make sure administrative functions are restricted appropriately,” he tells Assured Intelligence. “I would also emphasise visibility into what’s happening inside those environments. If someone starts creating unauthorised accounts, changing privileges or pulling large amounts of information through an internal API, teams should be able to detect and investigate that activity.”

Putting it all together

Not all of the recent attacks on Japanese firms hijacked or abused APIs, underscoring the need for multi-layered security, Greene continues.

“I would also emphasise visibility into what’s happening” Rich Greene

“Organisations need a combination of automated scanning, manual security assessments, access control testing and ongoing monitoring. They also need to make sure vulnerabilities are actually being addressed, as finding a problem doesn’t accomplish much if nobody takes ownership of fixing it,” he explains.

“Ultimately, I would encourage CISOs to focus on understanding their attack surface, addressing weaknesses before they’re exploited, and having the visibility necessary to recognise when something goes wrong.”

Cequence Security’s Barr agrees that CISOs must combine multiple defensive measures, so that “each layer covers a gap the others leave.” In this way, app testing finds design faults, vulnerability management catches known flaws on enterprise-owned assets, and runtime monitoring scans for abuse that looks legitimate.

“A sound programme starts with continuous discovery so the other layers have a complete list to work from, tests what it finds including the admin paths, patches by exposure and data sensitivity, and watches behaviour in production for what slips through,” Barr adds.

Here comes AI

AI is adding a new sense of urgency to these web and API-centric defensive efforts, as it promises to make the tedious work of finding misconfigured or insecure endpoints easier.

“AI does not need to find novel vulnerabilities to change the economics of this, it only needs to make enumeration less time-consuming,” says Approov’s Mazur. “Reconnaissance used to be the rate limiter on attacks against obscure targets. It is not anymore.”

Cequence Security’s Barr echoes these warnings, concluding bluntly: “Defenders should assume their hidden APIs will be found faster than before and plan on that basis.”

Whether they’re based in Tokyo or London, CISOs would be well advised to do just that.