SOCRADAR documents a dense wave of Japanese breach disclosures that began in late September and surged through October 2026. The firm’s Dark Web News logged 134 Japan-related items in the first half of October, more than all of September (129) and at roughly 8.9 per day.
By October 19, they noted a cluster of high-profile disclosures from brands such as Sourcenext, skyticket, Burger King Japan, Yakiniku King and Yamato Transport, with attacks often routed through internet-facing web services, contractors, or shared software. A SoftBank IDC Frontier cloud outage tied to ransomware affected about 495 customer organisations.
The wave also appeared alongside a publicly observed use of an AI-penetration tool called ARTEX in a subset of incidents, according to GMO Cybersecurity, raising questions about AI-enabled scalability of attacks.
Within the disclosed incidents, several organisations reported large data losses: Sourcenext’s breach involved a member-data API with 22.52 million records exposed (Oct 15), while skyticket saw 14.64 million records affected, Burger King Japan 11.18 million, Yakiniku King 10.79 million, and Ymirlink about 9 million from five systems via a compromised staff login.
Notable individual losses include Times Car with 6.6 million accounts and 1.6 million ID images, and Daiichikosho where malware on a contractor PC exposed 8.72 million records.
The wave’s drivers include aging web applications, supplier risk, and “App-to-Backend” attacks on mobile apps as NICT warned, with mitigation urging audits of internet-facing apps and APIs, heightened third-party scrutiny, edge-device hardening (including FortiGate CVE-2024-55591), and promotion of IC-chip identity checks ahead of the April 2027 deadline. No formal cyber state of emergency was declared; authorities issued advisories and opened a dedicated IPA help desk.