280 data leaks in 47 days: counting every one in Japan reveals apps' back doors under attack, and the arrival of AI that can hack

Yamato Transport's pay-later service, the Nikkei newspaper group, SourceNext, the Yakiniku King and Burger King restaurant apps, Bookoff. Each story reports one company at a time. So how much is happening in total?

We at DATA WORLD decided to count. We collected every leak and intrusion disclosed in Japan in the 47 days from September 1 to October 17, 2026. The result: 280, about six a day.

Counting showed more than volume. Attackers were going through smartphone apps' "back doors" and the places where many companies' data gather. And shortly before the wave, at the end of August, an AI model with strong hacking skills was released in a form anyone can download and run. What experts had warned about for years seems to be arriving.

We collected every disclosure, from September 1 to October 17, 2026, of a personal-data leak, unauthorized access or ransomware attack by a Japanese company, hospital, school, local government or national agency. The total was 280. Week after week, 25 to 50 disclosures kept coming.

Merging disclosures from the same incident leaves 220. Of these, 24 exceeded a million records and seven exceeded ten million, all seven disclosed from mid-September on.

Sources: organizations' notices and specialist media; compiled by DATA WORLD.

By sector, local governments and public bodies had the most incidents (43), followed by retail (26), schools (23) and IT and cloud (22). This is not one industry's problem.

The totals don't add up. Linkage is the real risk

Add up the 187 disclosures that gave a count and you get about 210 million, but that is not the size of the damage. Records, people and accounts are mixed, many are only "possible" leaks, and the same people appear in many leaks. Fancl and Attenir, for example, reported 834,947 records that covered 785,496 people.

What should worry us is separate leaks being joined. In data work, merging the same person across tables by email or phone number is called record linkage, and it works on leaked data too.

On October 15, the shoe maker Moonstar disclosed that a fake email impersonating it contained past order details only the customer and company could know. A message quoting your real order history is easy to mistake for the real thing.

How is the data being taken?

The first thing that stands out is how many cases don't say. In our tally, fewer than half of the cyberattack incidents named a specific entry point. Macnica found that of 81 web-system leaks disclosed since July, only 16 explained the cause in enough detail. Ransomware (malware that encrypts data and demands a ransom) accounted for only 13 incidents in our tally.

The best clue is an alert issued on October 8 by JPCERT/CC, Japan's computer emergency response team. It listed broad scanning for known vulnerabilities, a flaw in an analytics tool, planted web shells, and, most characteristic of this wave, taking apart smartphone apps to abuse their APIs.

One number away from someone else's data

Behind the screen, an app talks to the server through windows called APIs. Take the app apart and you learn which window to ask, how, and what comes back. If the server doesn't check whether the person asking may see that data, it hands over other people's data too.

Japan's privacy regulator describes exactly this kind of API abuse case in material revised on October 7: changing the member number in a URL after logging in returned others' data. The causes were APIs left out of management, responses returning unneeded data, sequential member numbers and no limit on bursts of requests. SourceNext also said an API returning member information was misused.

Break one hub, reach many

The other target is hubs. In our tally, 112 of the 280 disclosures, about 40%, came via vendors or cloud services.

A breach at the hiring platform ApplyNow led 17 organizations to disclose. A ransomware attack on IDC Frontier's cloud affected 495 companies and local governments. Yamato's pay-later service held buyers from about 4,100 online shops, and about 5.26 million records leaked, going back to orders from October 2018, eight years ago.

Try back door after back door until one has a weak lock, and go after the places where data gathers: that was this wave.

Probing that many apps and windows by hand is hard work. Which brings us to AI.

First, what is confirmed: none of the 280 cases has been confirmed as AI-assisted. Here is why we nonetheless think AI's influence is large.

Hacking-capable AI that anyone can download

In April 2026, Anthropic gave a handful of companies limited access to Claude Mythos Preview, a model so good at finding and exploiting unknown software flaws that it was not released publicly.

Days later, AI engineer and House of Councillors member Takahiro Anno sounded the alarm in the Diet. On April 15 he said other companies could build similar models "within a few months at the earliest, a year at the latest", calling it a race against time.

It took about four and a half months. China's Z.ai released GLM-5.3 on August 14 and, about two weeks later, published its weights for anyone to download. On September 17, CAISI, the AI evaluation center at the US National Institute of Standards and Technology, called GLM-5.3 "the most cyber-capable open-weight model released to date".

In October, Anno wrote on X that GLM-5.3 seemed "almost Mythos-class" and that his warning "has come true", urging faster action.

Views on the gap differ. In Anthropic's tests exploiting Chrome flaws, GLM-5.3 completed working exploits in 50 of 410 attempts against Mythos Preview's 56, nearly level. CAISI, looking across its full test suite, puts it about four months behind the best US models. Either way, hacking ability that was cutting-edge half a year ago is now available to anyone.

Safety rails, removed for about $4,400

Worse, a model you can run yourself is a model whose safety rails you can strip out.

Normal AI services are built to refuse to help with attacks. But with open weights, the refusal mechanism can be removed. When Anthropic tried, GLM-5.3's rate of refusing harmful requests fell from over 90% to a few percent, with little loss of capability. It cost about $4,400 in compute; an experienced team could do it for about $1,200.

Versions advertised as having their safety rails removed are already posted on model-sharing sites. With the smaller GLM-5.3-Flash, Anthropic built an exploit chain for known Chrome flaws with about 20 minutes of human effort and about $20 in usage. Its conclusion: "a critical threshold in freely accessible capabilities has now been crossed".

What the veterans said years ago

None of this came out of nowhere. Security expert Bruce Schneier wrote in 2021 that "at computer speeds, hacking becomes a problem that we as a society can no longer manage". In January 2024, the UK's NCSC predicted AI would "almost certainly increase the volume and heighten the impact of cyber attacks over the next two years".

Japan's numbers point the same way. Suspicious probing for weaknesses rose to 13,687 per IP address per day in the first half of 2026, up 50.7%, according to the National Police Agency. Cyber Security Cloud saw more than 1,200 requests from 326 IP addresses in about 40 minutes, changing tactics in response to what came back, and suggested AI agents. Japan's NICT warned on October 13 that AI makes app analysis and flaw-finding more efficient, so attacks that analyze apps to hit servers may spread. Abroad, an attacker using AI agents finished an intrusion in under ten hours that would take humans about two weeks.

If attackers use AI, what should defenders do? Use it too.

On May 18, Japan's National Cybersecurity Office and nine ministries jointly warned about misuse of high-performance AI and urged organizations to act quickly, including by actively using high-performance AI for cyber defense: detecting threats, responding to incidents, finding flaws. Anno's October 12 proposals to the government put "AI against AI" first.

There is evidence it works. IBM's 2026 study found organizations using security AI and automation extensively had breaches costing $1.93 million less than those that don't.

But AI is no cure-all. Anthropic reported 6,157 AI-found flaws to open-source maintainers, yet knows of only 516 fixed. AI finds flaws fast; fixing them still takes people, and they can't keep up.

That is why, alongside hardening with AI, shrinking the data you hold matters just as much. However well you defend, breaches happen, and data you don't hold can't leak. Yamato's leak reached orders from eight years ago. Japan's privacy regulator noted on October 7 that failures to delete unneeded data had made some leaks more serious.

The basic locks matter too. JPCERT/CC's measures were rate limits on APIs, permission checks on every endpoint, least privilege, and deleting data past its retention period: plain defenses that matter more, not less, in the age of AI.

Abroad, one big difference stands out: how heavily a leak itself is punished.

South Korea fines companies up to 3% of revenue when weak security leads to a leak; e-commerce giant Coupang was hit in June 2026 with a record ₩624.7 billion, with failure to delete departed members' data among the violations. A September amendment raised the cap to 10% of revenue for serious cases. In the EU, France's regulator fined the telecom operator Free and its mobile arm a combined €42 million for weak security and keeping departed customers' data too long.

Japan's privacy law amendment, passed in July, introduced surcharges for the first time, but they cover things like improper acquisition and sharing without consent, not leaks caused by weak security.

Still, Japan is moving.

• "Delete what you don't use; give contractors the minimum": from October 7 to 9, the privacy commission, the National Cybersecurity Office, METI, the communications ministry and the FSA issued alerts. The NCO listed prompt deletion of data that has served its purpose and making sure contractors delete data when work ends
• Reporting duties: since October 1, 258 critical-infrastructure operators in 15 sectors must report cyber incidents to the government
• Star ratings for contractors: METI plans to open applications around January-March 2027
• Identity checks without collecting images: from April 2027, bank account openings will in principle use IC-chip reading, and the FSA asked firms to switch early

One calm note for readers: an email or text that correctly quotes your order is not proof that it is genuine. If something looks off, check through the official app or a bookmark you already use, not a link in the message.

EDITOR'S TAKE ── Editor-in-Chief Ogasawara's reading

When attacks get cheap, design how much you hold

Checking 280 cases one by one, what stood out was not one careless company, but a world where the cost of attacking has suddenly dropped while services are still built the old way.

That AI would change hacking has been said for years. In 2026, hacking-capable AI became available to anyone, safety rails removable. The "months to a year" Anno warned of in the Diet took about four and a half months.

The link between this wave and AI is unproven. But defenders should assume that the effort needed to attack will keep falling.

Most of this wave exploited a design gap rather than advanced skill: not checking whether this person may see this record. An app's back doors can be read by taking the app apart. API permission design deserves the same weight as the lock on the front door.

Defending with AI is now essential. But breaches still happen, and data you don't hold can't leak.

In Korea and the EU, holding too much data is itself a ground for punishment, and Japan's agencies are now all saying "delete what you don't use". Data is an asset, but also inventory that must be protected for as long as you hold it. The cheaper attacks get, the more the amount you hold decides how strong your defense is. Now is the earliest time to take stock.