Japan's national computer emergency response center has published a breakdown of the methods behind a run of personal-data thefts at Japanese organizations since about September, describing attackers who pulled access keys out of smartphone apps and exploited a flaw in the Metabase analytics tool. None of the techniques is specific to Japan, which puts any company running consumer apps or self-hosted dashboards in the same position. The alert came as Japan's government urged greater vigilance Friday, The Associated Press reported.

What Happened

JPCERT Coordination Center (JPCERT/CC) issued the alert Oct. 8 and expanded it Oct. 9, Japan time. It treats the leaks as separate from routine ransomware intrusions and cautions that shared technical information is fragmentary and that the cases do not share one method. Business-intelligence dashboards and internal employee-management systems were among those breached and emptied of stored data.

The alert sorts what it has seen into four patterns:

RelatedFrance Widens Fridge-Hack Alert to More Controllers as Store Count Passes 350
  • Scanning each target for a range of known vulnerabilities, along with exploiting lapses such as exposed configuration or backup files.
  • Abuse of application programming interfaces (APIs), the channels apps use to talk to servers. Attackers dug API addresses and keys out of public smartphone apps, called internal functions the normal interface never exposes to change user privileges and create accounts, tampered with request headers and login tokens, used a "blind" database injection technique to enumerate accounts, and reused API keys stolen elsewhere.
  • Exploitation of a Metabase flaw through crafted API requests,.
  • Added Oct. 9: a web shell, a small program that lets an intruder run commands remotely, hidden in a Java archive placed on an application server reachable from a public web server.

The alert lists suspect internet addresses but names no attacker or victim and ties no pattern to a specific company.

The Metabase bug, tracked in the Common Vulnerabilities and Exposures (CVE) catalog as CVE-2026-72898, is a SQL injection flaw: it tricks the software into running database commands supplied by an attacker. JPCERT/CC's August alert says an unauthenticated attacker can use it to take administrator rights in Metabase. Versions 58 through 63 are affected until releases 58.24, 59.21, 60.17, 61.11, 62.9 and 63.5, and Metabase confirmed attacks began before a fix existed. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog Aug. 11, with an Aug. 14 deadline for federal agencies.

The Government Response

Japan's National Cybersecurity Office sent instructions to ministries to pass on to local public bodies and companies, covering current protections, strong passwords and supply-chain defenses, AP reported. Lawson, Daiwa Securities and BookOff have reported customer-data leaks, AP said, and car-sharing service Times Car lost data from about 6.6 million member accounts last month, as The Primary Wire reported. AP cited a Yomiuri newspaper and Trend Micro study counting more than 500 cases so far this year, against 473 in 2025 and 503 in 2024.

"The attacks are getting increasingly sophisticated," Digital Transformation Minister Toshiharu Furukawa told reporters this week, according to AP. Reuters reported that Furukawa convened ministries and agencies Thursday and cited TrendAI data showing 86 incidents in September alone.

Why It Matters

The API findings challenge a common assumption in app design: that functions without a button in the interface are effectively private. JPCERT/CC's account shows attackers reading apps to find those functions and the keys to call them. That makes API authorization a data-exposure question for executives, not a developer detail.

The Metabase thread matters because dashboards are usually wired into production databases. Metabase is an open-source tool developed in the U.S., so American deployments face the same exposure, and JPCERT/CC urges companies to apply the same checks to internal-only systems.

The center's advice includes rate limits on login, password reset, text-message and search functions; access control on every endpoint, documented or not; minimal, short-lived API tokens that can be revoked at once; patching; switching off unneeded internet-facing admin features; and deleting data past its retention period. The August alert adds a log check for Metabase compromise.

What to Watch

  • Further JPCERT/CC updates; the Oct. 9 revision added a pattern and more suspect addresses, and later ones could name affected products.
  • Additional breach disclosures by Japanese companies.
  • Whether Tokyo moves beyond guidance. Heise reported that a new law protecting critical infrastructure from cyberattacks took effect in October.
  • How much of the wave relied on AI tools, which Reuters said authorities are still investigating.