Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks

Summary: JPCERT/CC issued an October 8, 2026 alert on a series of personal data leaks at Japanese organizations, describing abuse of mobile app APIs and exploitation of known flaws, including CVE-2026-72898, a SQL injection flaw in Metabase with a CVSS score of 10.0 that CISA added to its Known Exploited Vulnerabilities catalog on August 11. Macnica counted 119 publicly disclosed incidents of personal data stolen or leaked through web systems at Japanese organizations through October 6, 2026, up from 84 in all of 2025 and 62 in 2024, with 81 of this year's cases coming in July or later.
Why it matters: Park24 reported about 6.6 million accounts affected and identity documents leaked from about 1.6 million accounts, while Monogatari Corporation reported 10,788,963 records leaked from its Yakiniku King app member system - and 65 of the 81 incidents disclosed since July gave too little detail to determine how attackers got in.

Read the original at The Hacker News ↗

Topics: Data Breaches
Related: TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026
Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026
City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026