EXPLORINEER
en

JP — ITmedia

Government Warns Businesses After Series of Data Leaks, Citing Multiple Cases of Insufficient Basic Security Measures

Security1 min read

Japan's government has warned companies that run websites and mobile apps. It says a series of personal data leaks happened because basic security steps were missing.

What happened

On November 5, the National Cyber Office (Cabinet Secretariat) published a warning for businesses. It says it found several recent data leaks that were likely caused by weak basic security. It asked companies to take security seriously.

How attackers work

The office thinks attackers scan many websites at once to find systems they can break into and steal personal data. It believes AI is likely helping them do this. Attackers can join several small, low-risk problems together to get into a system. This lets them hit many more companies at once.

Key facts

  • The warning was published on November 5, 2026.
  • The office found several cases caused by weak basic security.
  • Common problems include old software, unfixed known weaknesses, poor settings, and weak app security.
  • An earlier warning was published on October 9.

Why it matters

Many companies that hold customer data could be targets. Simple steps, such as fixing software and using multi-factor (extra login) checks, can greatly lower the risk of a leak.

What to watch

  • Whether companies follow the three areas of advice: running systems, building apps, and controlling links to partners.
  • Whether more leaks are reported, especially those linked to AI-driven attacks.
  • Whether the government adds new rules or guidance for businesses.

Glossary

National Cyber Office (Cabinet Secretariat)
The Japanese government office that leads national cyber security work.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

Securityheise online

Lockdown Mode Bypassed: How Calif.io's Latest Exploit Works

Security researcher Stefan Esser of Calif.io says his jailbreak for current iPhones, up to iOS 27.0.1, works even with Lockdown Mode enabled, and that he kept Lockdown Mode on during the demonstration. The exploit uses a bug in the PDF parser, which Lockdown Mode does not block, since the file is opened via Safari or AirDrop and shown in Preview, where MTE memory protection is active only in Lockdown Mode and was bypassed. Esser also says the exploit persists through the update to iOS 27.2, because the bug lies in a part of the system the update does not touch.

SecurityZDNet Korea

Joshin President Apologizes Over Possible Leak of 6 Million Personal Records

Joshin, a Japanese electronics retailer based in Osaka, has apologized after an unauthorized third party accessed its member information database server, potentially exposing more than 6 million customer records, including names and addresses. The company also said driver's license images, a My Number card record, and five bank account numbers may have been leaked. To prevent recurrence, Joshin plans to stop holding unnecessary customer information and has begun deleting it.

SecurityThe Register

Hospital gave very sick doctor a special PC for his personal, erm, pleasure

In this On Call column, a reader named Mason recounts supporting a hospital research lab run by a prominent organ transplant researcher who repeatedly caused malware infections by visiting adult sites on his office PCs. Management did not discipline him after a worm outbreak; instead, the IT department gave him a designated PC for personal use, and Mason's boss told him to comply or find another job. Mason later learned that the PC was cited as evidence in a lawsuit filed by the doctor's graduate students.

SecurityITmedia

Unauthorized Access Hits Security Awareness Group; Up to 15,000 Personal Records Possibly Leaked

The Japan Network Security Association (JNSA) said a third party gained unauthorized access to its "Information Security Comprehension Check Service," possibly leaking up to 15,128 personal records, including user IDs and hashed passwords. The service has been suspended while JNSA and external specialists investigate the cause and scope; the entry route is not yet known. JNSA plans to notify affected individuals once identified and report to the Personal Information Protection Commission, and warns users to beware of phishing emails that may use the leaked information.