Japan’s Cyberattack Surge Exposes Gaps in Business Defenses

Japan’s latest cyberattack wave is exposing how quickly risks are spreading across its corporate economy. At least 81 incidents have been reported since July, nearly a third of the total recorded over the past three years, according to Yutaka Sejiyama, deputy director of the Macnica Security Research Center. The attacks are hitting organizations across sectors, while many companies are still working through gaps in basic defenses.

The incidents include a breach of a website holding electricity and gas trading information, disclosed Wednesday, and hackers’ claim that they published sensitive customer data from currency trading platform GMO Internet Group Inc. Those cases followed emergency measures at Mizuho Financial Group Inc. and other companies after vulnerabilities in the widely used PHP programming language came to light last week.

For businesses, the immediate concern is the breadth of exposure. Hackers are targeting publicly accessible systems, especially those that store personal information, Sejiyama said. “They are stealing whatever information they can obtain from vulnerable websites.” That approach can put customer data and business operations at risk even when an organization isn’t part of a high-profile industry.

AI tools lower barriers for attackers

Tom Kellermann, vice-president of AI security and threat research at TrendAI, a unit of Trend Micro Inc., described this year’s rise in cybercrime in Japan as unusually sharp. He said prominent Russian-speaking groups, including LockBit and Qilin, are responsible for many attacks; in some cases, they are suspected of working with North Korean hackers.

Artificial intelligence and open-source hacking tools are expanding what these groups can do. AI can help attackers examine complex networks, locate weak points, deliver attack capabilities and avoid detection, Kellermann said. Those tools also make it easier to overcome language barriers and exploit older systems. In practice, that means a target’s size or profile may offer little comfort if its internet-facing systems are vulnerable.

Daiki Fukumori, director of the cybercrime countermeasures center at GMO Cybersecurity by Ierae Inc., linked many recent attacks to ARTEX, a Chinese-developed tool designed to test cyberdefenses. The same tool was associated with a wave of breaches at South Korean banks last month. The connection points to techniques that can move across borders and sectors, leaving companies with little time to treat attacks as isolated incidents.

Japan’s industrial conglomerates are important links in global technology supply chains, and the country holds the world’s second-largest savings pool. Both features increase the potential payoff for attackers. Smaller firms also face exposure: Benjamin Bartlett, a Miami University professor specializing in cybersecurity, said many Japanese small businesses have substantial cash reserves but inadequate IT security. He said financially motivated hackers have targeted many such companies during the current wave.

A move toward earlier detection

Japan’s cyber defenses have long raised concerns. Last year, ransomware halted operations at Asahi Group Holdings Ltd., while an attack on Askul Corp. disrupted its e-commerce platform. The current run of incidents, however, is described by experts as without precedent in scale. The clustering since July underscores how quickly a steady risk can turn into a sustained operational burden.

The response is shifting from investigating incidents after they happen toward monitoring online communications traffic to spot and neutralize threats earlier. Cybersecurity became a national priority over the summer, with attention on safeguarding essential infrastructure. New legislation has also lifted some restrictions on monitoring communications, including traffic from overseas; some provisions took effect earlier this month.

Motohiro Tsuchiya, a Keio University professor in Tokyo who serves on a cybersecurity advisory panel, said Japan remains well behind its peers. “We are much, much weaker than other G7 countries,” he said, adding that Japan is receiving training and advice from American, Australian and British security services. He has linked the gap in part to past limits on monitoring communications.

Spending is rising, but experienced staff remain scarce. “Developing and securing highly capable cybersecurity personnel is an urgent task if we are to respond to and deal with threats appropriately,” chief spokesman Minoru Kihara said Thursday. More funding can support tools and preparedness, but companies and public institutions still need people who can maintain systems, interpret alerts and act when threats emerge.

Business costs are already visible

For smaller technology providers, the strain is immediate. Yoshiyuki Hanaya of Osaka-based website developer ID-TECHS said AI-driven attacks have risen sharply over the past six months. He returned early from a business trip to prepare for a PHP software patch released late at night, then spent days handling client requests. “Other than eating, going to the bathroom, bathing and sleeping, I’ve basically been in front of my PC the entire time,” he said.

That account captures a cost that incident counts don’t show: staff time diverted from routine work, emergency patching and support demands that can cascade from one vendor to its customers. Companies with limited technical teams may have fewer resources to inspect their systems and respond quickly, while a breach involving customer information can affect people beyond the organization itself.

Japan’s experience may also offer a wider warning. Bartlett said Japanese companies are “more of a bellwether for what is to come, rather than uniquely bad,” and added, “I don’t think anyone’s prepared for this.” The next test will be whether better monitoring, timely patching and enough skilled staff can keep the current pace of attacks from turning into broader disruption across connected businesses.

Japanese Prime Minister Sanae Takaichi; photo credit: Rie Kikuchi/AFP/Bloomberg