Japan's corporate breach wave shows AI changing how hacking works

AISemiAnalysis says 18 Japanese companies have disclosed breaches since September 25, including Tokyo Metro, Japan Post, Lawson, Nikkei, Yamato and Sagawa. JPCERT/CC reported that attackers used AI to scan for known vulnerabilities and attack company APIs, often by pulling endpoints and keys from Android apps.

AIWhy it matters.

The post links a wave of Japanese corporate breaches to AI-assisted vulnerability scanning and API attacks, with dated examples that help readers judge the trend.

SemiAnalysis

@SemiAnalysis_

View on X

Japan’s wave of corporate breaches is the latest sign that AI is changing how hacking works.

Since Sept 25, 18 Japanese companies have disclosed breaches, including Tokyo Metro, Japan Post, Lawson, Nikkei, Yamato and Sagawa. Attackers got about 6.6M Times Car accounts, some with driver’s license images. Burger King Japan says 11.18M app member records were affected, and Sourcenext says up to 22.5M records may be out.

Last week, JPCERT/CC, the country’s national computer emergency response team, posted its findings from the investigations into these breaches. The attackers used AI to scan for known vulnerabilities and to attack companies’ APIs. Often they did this by pulling apart a company’s Android app to find the endpoints and any keys left in the code. It is also no surprise that Japanese companies are particularly vulnerable. Japan is still catching up on basic digitization, with many offices still using fax machines to this day!

Now even the PM is getting involved, urging anyone running a PHP website to patch two critical vulnerabilities immediately, or temporarily take the site offline if they can't.
https://x.com/takaichi_sanae/status/2112890642590564386

高市早苗@takaichi_sanae

皆様に、今夜に対応して頂きたい大至急のお願いです。多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X

View quoted post on X

Source details

SemiAnalysis · x.comPublished Oct 21, 9:35 PM ET · added here 9:57 PM ET

Original title: Japan’s wave of corporate breaches is the latest sign that AI is changing how hacking works.

Japan's corporate breach wave shows AI changing how hacking works

AIWhy it matters.

Topics

Tags