Japan Reports 81 Cyberattacks Since July as AI Raises Risks for Businesses
At least 81 incidents have been reported since July. Japan is shifting toward earlier threat detection as firms face more AI-assisted attacks.
Japan has reported at least 81 cyber incidents since July, nearly one-third of the attacks recorded there over the past three years. The pace is testing businesses and exposing how quickly AI tools can help attackers find weaknesses in online systems.
The incidents have reached companies across sectors, including brokerages and delivery firms. A website carrying electricity and gas trading information was breached on Wednesday. Days earlier, hackers said they had published a large set of sensitive customer data from currency trading platform GMO Internet Group Inc. For businesses that hold personal or financial information, the pattern points to a broad exposure: attackers are going after accessible websites and taking whatever data they can reach.
AI is widening the pool of targets
Experts describe an unusually sharp rise in cybercrime in Japan this year. Tom Kellermann, vice-president of AI security and threat research at TrendAI, a unit of Trend Micro Inc., said prominent Russian-speaking criminal groups, including LockBit and Qilin, are behind many attacks. In some cases, he said, those groups are suspected of working with North Korean hackers.
AI agents and publicly available hacking tools have lowered barriers for criminal groups. Attackers can use AI to examine complex networks, identify vulnerable targets, deliver attack capabilities and avoid detection, Kellermann said. That can make older infrastructure easier to probe, while helping hackers work around language barriers.
Daiki Fukumori, director of the cybercrime countermeasures center at GMO Cybersecurity by Ierae Inc., linked many recent attacks to ARTEX, a China-developed tool for testing cyberdefenses. The same tool was connected to a wave of breaches at South Korean banks the previous month.
The exposure is not limited to large firms. Benjamin Bartlett, a Miami University professor specializing in cybersecurity, said many smaller Japanese companies have substantial cash reserves but inadequate IT security. He said financially motivated hackers have targeted many firms of this kind during the current wave. In his view, Japanese businesses may be signaling risks that companies elsewhere will also face, rather than being uniquely vulnerable.
Recent incidents add to a longer record
The latest attacks follow earlier disruptions. A ransomware incident last year halted operations at Asahi Group Holdings Ltd. Askul Corp. suffered a breach that interrupted its e-commerce platform. The new surge differs in scale: at least 81 incidents have been reported since July, according to Yutaka Sejiyama, deputy director of the Macnica Security Research Center.
Sejiyama said the current activity reflects a shift toward indiscriminate attacks on publicly accessible web systems, especially those holding personal information. His description carries a practical message for organizations: a company does not need to be a high-profile target to face exposure if its website is reachable and vulnerable.
Last week, companies also rushed to address flaws in PHP, a widely used programming language. Mizuho Financial Group Inc. was among those that introduced emergency measures after the vulnerabilities became known. Yoshiyuki Hanaya of Osaka-based website developer ID-TECHS said the sharp increase in AI-driven attacks over the past six months has made this work more demanding. He returned early from a business trip to prepare for a late-night PHP software patch, then spent days responding to client requests.
“Other than eating, going to the bathroom, bathing and sleeping, I’ve basically been in front of my PC the entire time,” Hanaya said.
Japan is changing its approach
Japan has long faced concerns about its cyber defenses, but experts say the recent barrage is unprecedented. The country had focused largely on investigating incidents and responding after they happened. Its approach is now shifting toward monitoring online communications traffic to spot potential threats earlier and try to neutralize them.
That shift follows a summer decision by Sanae Takaichi’s administration to make cybersecurity a national priority, with attention to critical infrastructure. Motohiro Tsuchiya, a Keio University professor in Tokyo and a member of an advisory panel on cybersecurity, said Japan remains far behind other G7 countries. He said the country is receiving training and advice from American, Australian and British security services.
Tsuchiya attributed part of the gap to restrictions on monitoring communications, including traffic from abroad. New legislation has loosened some of those limits, with some changes taking effect earlier this month. Japan has also committed additional funds to cybersecurity. Finding enough experienced staff remains a major obstacle.
“Developing and securing highly capable cybersecurity personnel is an urgent task if we are to respond to and deal with threats appropriately,” chief spokesperson Minoru Kihara said Thursday.
For businesses, the combination of rising attack activity and a shortage of skilled staff means technical fixes can compete for attention and time. Japan’s experience also shows how a widely used software flaw can trigger urgent work across organizations at once. Reviewing exposed systems, applying available patches and checking how personal data is stored are practical steps as companies respond to this kind of activity. The next test will be whether earlier detection and stronger technical capacity can keep pace with attackers using AI.
Related reading: Companies respond to PHP vulnerabilities; Japan’s cyber chief says the country remains behind; Japanese companies compensate users after cyberattacks; AI tool linked to breaches at Korean banks also used in Japan; and AI lowers barriers for cybercriminals in South Korea and Japan.
