# Japan's corporate breach wave shows AI changing how hacking works

> Original title: Japan’s wave of corporate breaches is the latest sign that AI is changing how hacking works.

- Source: SemiAnalysis
- Published: 2026-10-22T01:35:15.000Z
- Bad Influence: https://badinfluence.news/items/wcea3f7b63x8h7r56h3jj12fz
- Original: https://x.com/SemiAnalysis_/status/2113081719817380193

## Summary

SemiAnalysis says 18 Japanese companies have disclosed breaches since September 25, including Tokyo Metro, Japan Post, Lawson, Nikkei, Yamato and Sagawa. JPCERT/CC reported that attackers used AI to scan for known vulnerabilities and attack company APIs, often by pulling endpoints and keys from Android apps. The post also quotes Prime Minister Takaichi urging PHP website operators to patch two critical vulnerabilities immediately.

## Why it matters

The post links a wave of Japanese corporate breaches to AI-assisted vulnerability scanning and API attacks, with dated examples that help readers judge the trend.

## Post

Japan’s wave of corporate breaches is the latest sign that AI is changing how hacking works.

Since Sept 25, 18 Japanese companies have disclosed breaches, including Tokyo Metro, Japan Post, Lawson, Nikkei, Yamato and Sagawa. Attackers got about 6.6M Times Car accounts, some with driver’s license images. Burger King Japan says 11.18M app member records were affected, and Sourcenext says up to 22.5M records may be out.

Last week, JPCERT/CC, the country’s national computer emergency response team, posted its findings from the investigations into these breaches. The attackers used AI to scan for known vulnerabilities and to attack companies’ APIs. Often they did this by pulling apart a company’s Android app to find the endpoints and any keys left in the code. It is also no surprise that Japanese companies are particularly vulnerable. Japan is still catching up on basic digitization, with many offices still using fax machines to this day! 

Now even the PM is getting involved, urging anyone running a PHP website to patch two critical vulnerabilities immediately, or temporarily take the site offline if they can't. 
https://x.com/takaichi_sanae/status/2112890642590564386

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHVMsoFRW4AAQM2a.jpg&mode=thumb&exp=1793404800&sig=404c454dbcc0df71)

## Quoted post @takaichi_sanae

> 皆様に、今夜に対応して頂きたい大至急のお願いです。
>  
> 多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
>  
> 公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
>  
> 修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
>  
> 国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
> 国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X

https://x.com/takaichi_sanae/status/2112890642590564386

### Quoted post, AI translation

> To everyone: this is an urgent request that needs action tonight.
> 
> The PHP security team has issued an alert about two serious vulnerabilities in PHP, which is used by many websites.
> 
> Please check whether the websites you operate use PHP, and prepare to apply the fix patch that will be released tonight, October 21 at 11:00 PM (Japan time), as quickly as possible.
> 
> If it is difficult to apply the patch promptly, temporarily suspending websites and similar services may be one effective way to reduce the risk.
> 
> The National Cyber Office is also sharing related information on its X account, so please refer to it as well.
> National Cyber Office (Attention/Alert Information) (@cyber_forecast) / X