Japan's Web Data Leaks Surge Amid API Abuse and Metabase Exploitation

JPCERT/CC warned of large personal-data leaks at Japanese organizations involving mobile-app API abuse, access-control and authentication weaknesses, and exploitation of known vulnerabilities. Macnica recorded 265 publicly disclosed web-system breach incidents from January 2024 through October 6, 2026, including 119 in 2026 and 81 disclosed since July. The incidents affected a broad range of services, not primarily e-commerce sites. Separately disclosed breaches affected approximately 6.6 million Times Car accounts and exposed 10,788,963 records from the Yakiniku King app's member system; their causes remained under investigation.

JPCERT/CC also highlighted exploitation of CVE-2026-72898, an unauthenticated SQL injection vulnerability in Metabase that can enable administrator access and compromise connected databases. Defenders should upgrade Metabase to supported fixed releases, patch other exposed software, review access logs and suspicious API activity, enforce endpoint authorization and token controls, strengthen administrator authentication, and minimize retained personal data. Approximately 80% of recent public disclosures lacked sufficient detail to classify the intrusion method. Neither organization attributed the breaches to a named actor or established a common cause, and evidence has not confirmed AI involvement or AI-discovered zero-day exploitation. Similar incidents overseas, particularly in South Korea, also leave claims of Japan-exclusive targeting unsubstantiated.