Threat actorhighExploited in the wild

Japan cyber incident reports rose 48% in Q3 2026

Original title: Behind Japan’s Warnings of a Cyber Crisis

Recorded Futureby Insikt Group®Oct 22, 2026 · 00:00 UTC (8d ago)6 min read6 · 3 reads

AI summary · x-ai/grok-4.7Summaries by Vani AI

Insikt Group counted 918 reports, up from 621, alongside multi-million-record breaches and an IDCFrontier ransomware outage.

Insikt Group says reported cyberattacks on Japanese organizations rose from 621 in Q2 2026 to 918 in Q3. Masaaki Taira of Japan's National Cybersecurity Strategy Headquarters declared a cyberspace state of emergency after high-profile breaches. Cited cases include about 33 million EPARK PeakManager records, 6.6 million Times Car accounts, ransomware at IDCFrontier affecting 495 organizations, and 22,519,960 Sourcenext records taken through a member API. JPCERT/CC linked recent incidents to unpatched flaws, API abuse, Metabase CVE-2026-72898, and web shells.

Unconfirmed: Macnica could not confirm AI use, and the specific models allegedly abused are unconfirmed.

Key facts

Trend Micro counted 86 attacks in September and said January-September exceeded all of 2025.
IDCFrontier's October 7 ransomware incident disrupted 495 companies and local governments.
Sourcenext's October 13 breach exposed names, emails, passwords, and other PII.
GMO reportedly tied ARTEX to attacks on about 80 Japanese companies.
Macnica said about 68% of 119 disclosed 2026 cases came since July.

Security assessment · AI, from the articleExploited in the wild

Impact: PII exposure, service disruption, and web compromise

Product	Affected
Metabase	—

What to do

1.Patch known flaws, including Metabase CVE-2026-72898.
2.Review API credentials and member-information API access.
3.Look for .war and .jsp web shells on exposed servers.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-72898

ATT&CK: T1190 Exploit Public-Facing Application T1505.003 Web Shell T1078 Valid Accounts

Tags: japan ransomware metabase web-shells artex data-breach

Products: Metabase ARTEX
Threat actors: TAG-217
Victims: EPARK Times Car IDCFrontier Sourcenext
Organizations: Insikt Group National Cybersecurity Strategy Headquarters JPCERT/CC Personal Information Protection Commission IPA Macnica GMO Cybersecurity by Ierae Trend Micro
Countries: Japan South Korea

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-72898	Unauthenticated SQL Injection in Metabase Grants Admin Access	10.0	99%	KEVPoC ×3	Aug 10, 2026 KEV Aug 11, 2026

From the original article

6 min read at recordedfuture.com

Explore Japan's 2026 cyber crisis, rising breach trends, AI tooling, legacy systems, and key mitigation strategies to protect organizations.

Recorded Future

By Insikt Group® · recordedfuture.com

Read the full article at Recorded Future

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.