Web Data Exposure Incidents Rise Sharply in Japan Amid API and Metabase Attacks

Japan's incident response authority, JPCERT/CC, has warned of a growing wave of data exposure incidents in which attackers are abusing mobile application APIs, exploiting publicly known vulnerabilities, and targeting internet-accessible business systems to steal large volumes of personal information.

The October 8 alert, based on incident reports received by the organization and additional intelligence gathered during investigations, highlights a series of breaches affecting Japanese organizations throughout 2026. While JPCERT/CC did not attribute the activity to any specific threat group or identify impacted organizations, it noted that multiple incidents share similar attack patterns involving unauthorized API access and exploitation of vulnerable web applications.

Personal Data Leaks Continue to Increase

According to JPCERT/CC, the incidents differ from typical ransomware attacks and are notable for the large amounts of personal information exposed. Many of the affected systems included not only consumer-facing applications but also internal business intelligence platforms, administrative portals, and employee management systems that were never intended to be publicly accessible.

The agency cautioned that its visibility into the attacks remains incomplete and that not every victim was necessarily compromised using the same techniques. Nevertheless, reports suggest a sustained increase in such breaches since around September 2026.

Supporting that assessment, Japanese cybersecurity firm Macnica reported that 119 web-related personal data breach incidents had been publicly disclosed in Japan between January and October 6, 2026. That figure exceeds the 84 incidents recorded during all of 2025 and the 62 reported in 2024. Notably, 81 of those 119 incidents emerged after July 2026, indicating a sharp acceleration in attack activity.

Macnica emphasized that its figures exclude ransomware incidents and breaches associated with unrelated threat groups, focusing only on attacks believed to resemble the current campaign.

Breaches Impact Diverse Services

The scope of affected systems has expanded significantly beyond traditional e-commerce targets.

Recent incidents have reportedly affected:

• Online retail platforms
• Membership and loyalty services
• Internal business applications
• Customer support systems
• Library catalog platforms
• Transportation reservation services

Several high-profile disclosures demonstrate the scale of the problem.

Car-sharing service Times Car, operated by Park24, reported that attackers gained access to data associated with approximately 6.6 million accounts. The company later disclosed that identity verification documents, including driver's license images, belonging to roughly 1.6 million users had also been exposed.

Meanwhile, Monogatari Corporation, operator of the Yakiniku King restaurant chain, disclosed a breach affecting more than 10.7 million records within its membership application infrastructure.

International Activity Suggests a Broader Campaign

Macnica observed similar incidents beyond Japan, identifying 99 comparable cases across 13 countries and regions.

Among the affected countries were:

• South Korea (30 cases)
• France (11 cases)
• Poland (8 cases)

Researchers noted that differences in disclosure requirements and reporting practices make it difficult to determine whether Japan is being specifically targeted or simply reporting incidents more transparently than other regions.

Three Major Attack Patterns

JPCERT/CC identified three recurring attack methods appearing throughout the incidents.

1. Abuse of Mobile Application APIs

The most commonly observed technique involves direct interaction with backend APIs supporting mobile applications.

Investigators reported multiple methods used to obtain unauthorized access:

Reverse Engineering Mobile Apps

Attackers analyze publicly available smartphone applications to identify:

• API endpoints
• Authentication mechanisms
• Embedded API keys
• Backend service structures

Once discovered, these interfaces are accessed directly rather than through the application's normal user interface.

Targeting Hidden Internal APIs

Several incidents involved APIs that were never exposed through the application's visible functionality.

Reported abuse included:

• Unauthorized privilege escalation
• Creation of rogue accounts
• Manipulation of authorization mechanisms
• Enumeration of account information
• Blind NoSQL injection attacks

Attackers were also observed comparing server behavior when requests contained modified headers, malformed tokens, or unexpected authentication parameters.

Reuse of Stolen API Keys

In some cases, threat actors leveraged API credentials stolen from previously compromised systems.

Macnica's investigation found examples where attackers extracted API keys from mobile applications and subsequently accessed backend services in ways that appeared indistinguishable from legitimate user activity.

Exploiting Application Logic Weaknesses

Researchers found that attackers systematically searched web applications and APIs for weaknesses that exposed data, including:

• Overly permissive APIs
• Excessive data exposure
• Broken access controls
• Anonymous access to member-only functions
• Business logic flaws
• Session management weaknesses

Several incidents also involved attacks against poorly protected administrative interfaces and the exploitation of known software vulnerabilities.

2. Broad Vulnerability Scanning Campaigns

A second possibility raised by JPCERT/CC is that attackers are not relying on a single universal vulnerability.

Instead, they may be conducting large-scale reconnaissance campaigns, scanning each organization individually for:

• Known vulnerabilities
• Misconfigured systems
• Exposed backup files
• Leaked configuration files
• Weak administrative controls

This approach would allow attackers to compromise diverse targets regardless of their technology stack.

3. Exploitation of Critical Metabase Vulnerability

The third major attack pattern involves active exploitation of CVE-2026-72898, a critical SQL injection vulnerability affecting Metabase, the widely used open-source business intelligence platform.

Why the Vulnerability Is Dangerous

The flaw carries a maximum CVSS severity score of 10.0 and was reportedly exploited as a zero-day against Metabase's own cloud service before becoming publicly known.

The vulnerability allows unauthenticated attackers to inject SQL commands into Metabase's internal application database.

Successful exploitation can lead to:

• Administrator-level access
• Theft of database credentials
• Access to connected data sources
• Unauthorized exports of sensitive information

Because Metabase is commonly connected directly to corporate databases, a compromise can provide attackers with immediate access to valuable business and customer data.

Continued Exploitation After Patches

Despite the availability of fixes, attacks continued after disclosure.

Presentation platform AhaSlides later confirmed that attackers exploited the vulnerability within its Metabase environment and maintained access for nearly a month before detection.

JPCERT/CC's latest advisory includes three IP addresses and two User-Agent signatures linked to exploitation attempts observed between August and September 2026.

Indicators of Possible Compromise