Threat reportData BreachTL-2026-3956
Japan October 2026 Data Breach Surge: Web/API Compromises, Supplier Breaches, IDC Frontier Ransomware and AI-Assisted Probing (ARTEX)
Japan October 2026 Data Breach Surge (TL-2026-3956), also tracked as Japan October 2026 Breach Surge, is a high-severity data breach, first published 2026-10-20. It has no confirmed attribution, affects Fortinet FortiGate (FortiOS), references 1 CVE (CVE-2024-55591), maps to 10 MITRE ATT&CK techniques (T1078, T1190, T1199), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-3956
- Threat ID
- TL-2026-3956
- Also known as
- Japan October 2026 Breach Surge, ARTEX AI-assisted probing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, ecommerce, transport, logistics, finance, news - media, education, insurance, food-service, cloud-hosting, entertainment, government administration
- Target regions
- japan, south korea
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Japan October 2026 Data Breach Surge
Malware and tooling: AgendaCrypt, Akira, Everest, safepay, the gentlemen, ARTEX, Claude Code, DeepSeek v4.1-flash
How Japan October 2026 Data Breach Surge works
At least 20 major Japanese companies disclosed breaches between late September and October 19, 2026, mostly via internet-facing web services, member apps/APIs, contractors and shared suppliers, alongside the IDC Frontier ransomware outage affecting 495 organizations. GMO Cybersecurity by IERAE confirmed traces of the Chinese-developed autonomous AI pentest tool ARTEX on attack infrastructure targeting about 20 Japanese companies, eight of which had disclosed breaches.
SOCRadar (2026-10-20) reports a surge of Japanese data-breach disclosures: 36 organizations issued first breach notices between Sep 25 and Oct 8, and 119 Japanese web compromises were tracked by Oct 6, 2026 versus 84 for all of 2025 (81 of the 119 after July). Largest disclosed exposures include Sourcenext (22.52M records via member-data API abuse, Oct 9-13), E-Store/ShopServe (~23.36M, May-Aug 2026 intrusion), skyticket (14.64M, admin function manipulation), Burger King Japan (11.18M, official app member system), Yakiniku King (10.79M, app member management system), Ymirlink (~9M records from 5 systems via a stolen support-staff login), Daiichikosho (8.72M, malware on a contractor PC), Times Car/Park24 (6.6M accounts and 1.6M ID images via a 20-year-old web system), Ride On Express (6.5M, ransomware at a hosting provider), Bookoff, Yamato Transport, Lawson, JR East, Nikkei (stolen credentials / development system), GMO Research (software vulnerability) and Daiwa Securities (contractor FAQ system admin login).
Supplier and shared-platform compromises created single points of failure: IDC Frontier's IDCF Cloud (East Japan Region 1) was hit by ransomware at 03:40 JST on Oct 7, 2026, taking 495 companies and local governments offline, including JR East email; a console message claimed 225 databases encrypted (3.6 PB), 239 hypervisors reached, 16,000 VM disks sealed and 554,153 snapshots wiped. By the 5th update (Oct 14) no data exfiltration evidence had been found and 194 of 495 customers could restore; the entry vector and ransomware family were not disclosed. Other supplier incidents: Scala Communications (FAQ platform exposing up to 5 clients including Daiwa Securities and Citizen Watch), Commune (communities run by Yamaha, Suzuki, Sansan, LINE Yahoo), and Studio (website builder cloud-environment feature flaw affecting Saitama Prefecture sites). SOCRadar names CVE-2024-55591 (FortiGate) among specific vulnerabilities and recommends reviewing FortiGate configurations and rotating VPN credentials.
On Oct 19, 2026 GMO Cybersecurity by IERAE reported confirming use of ARTEX, an autonomous LLM multi-agent penetration-testing system, from attack infrastructure targeting about 20 Japanese enterprises (9 in the same industry; 8 had already disclosed breaches). It also identified six further AI-based attack infrastructures with country- and industry-specific campaigns (retail/digital gifts, education/printing, marketing, insurance/finance, e-commerce/media/logistics, e-commerce). GMO published no IOCs and shared findings with law enforcement; the actor is not named. Separately, public reporting (CrowdStrike analysis via BleepingComputer/The Hacker News) ties ARTEX, developed by 'Autumn-27', to a financially motivated, likely Chinese-speaking operator who breached South Korean financial institutions (Shinhan Bank, KB Kookmin, Hana, BNK Busan, Yegaram Savings Bank) from late September to early October 2026 using DeepSeek v4.1-flash, GLM-5.3, Grok 4.6 and Claude Code sessions. The IP 38.244.50.120 and domain xcai.pro belong to that Korean campaign; no source ties them to the Japanese infrastructure. ARTEX's developer halted public releases on Oct 8 and went closed-source, though derivatives circulate. NICT (Oct 13) warned of A2B (App-to-Backend) attacks in which adversaries reverse-engineer public Android apps to map backend APIs and exploit server-side flaws, with AI making that analysis faster and cheaper.
Ransomware groups also posted Japanese victims in 2026: The Gentlemen (22), Qilin (14), Everest (9), Safepay (7), AiLock (5), Nightspire (5), Akira (4), LockBit5 (4), Metaencryptor (3). Qilin claimed Keio Corporation on Oct 15. Japanese authorities declared no state of emergency; IPA opened a special help desk on Oct 16 and the FSA requested IC-chip identity verification by April 1, 2027. Attribution of the Japanese breaches to a single actor is not established; the campaign is a cluster of independent incidents with a shared AI-assisted tooling thread.
MITRE ATT&CK techniques used in TL-2026-3956
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Collection
T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Impact
T1485 Data Destruction; T1490 Inhibit System Recovery
Resource Development
T1583.003 Virtual Private Server; T1588.002 Tool
Reconnaissance
Affected products and versions in Japan October 2026 Data Breach Surge
- Fortinet — FortiGate (FortiOS)
Vulnerable versions: Versions affected by CVE-2024-55591
Fixed in: Fortinet-patched releases - IDC Frontier (SoftBank) — IDCF Cloud East Japan Region 1
Vulnerable versions: East Japan Region 1 - Studio — Studio website builder
Vulnerable versions: Cloud environment feature flaw - Various Japanese enterprises — Member web systems, mobile app backends and APIs
Vulnerable versions: Internet-facing member and admin functions
Remediation for Japan October 2026 Data Breach Surge
Patches
- Apply Fortinet fixes for CVE-2024-55591
- Apply vendor fixes for affected member-system and website-builder platforms as released
Immediate actions
- Audit all internet-facing web applications, member systems and mobile-app backend APIs; rate-limit and alert on abnormal API data volume
- Review third-party, SaaS, hosting and contractor access to customer data and revoke unused support/admin accounts
- Patch FortiGate (CVE-2024-55591), review device configurations and rotate VPN and administrative credentials
- Hunt for ARTEX-style automated, high-rate, multi-stage probing against web and API endpoints
- Monitor dark web forums, Telegram and ransomware leak sites for organizational data
Workarounds
- Restrict FortiGate management interfaces from the internet
- Contact the IPA special help desk for incident response guidance
Longer-term hardening
- Minimize retention of ID and driver-license images and personal data
- Retire legacy web systems and enforce MFA on all admin and support-staff logins
- Adopt API security testing against A2B attacks including reverse-engineered mobile apps
- Maintain offline, segmented backups and test restoration of hosted workloads
- Contractually require suppliers to report incidents and segment shared platforms per customer
CVEs associated with Japan October 2026 Data Breach Surge
Weaknesses (CWE) in Japan October 2026 Data Breach Surge
Timeline of Japan October 2026 Data Breach Surge
- Times Car/Park24 discloses breach (6.6M accounts, 1.6M ID images) via a 20-year-old web system, the earliest in the wave
- Yakiniku King (10.79M), GMO Research (894,082) and Daiwa Securities (~110K) disclose breaches
- Ransomware hits IDCF Cloud East Japan Region 1 at 03:40 JST, taking 495 companies and local governments offline
- ARTEX developer halts public releases and moves the project to closed source; Daiichikosho discloses 8.72M-record breach via contractor PC malware
- skyticket (14.64M), Bookoff (6.43M) and JR East (2.06M, IDCF-hosted email) disclose; FSA issues ID-image guidance
- NICT publishes advisory on A2B (App-to-Backend) attacks using reverse-engineered Android apps; Ride On Express discloses ransomware at hosting provider
- IDC Frontier 5th update: no exfiltration evidence found; 194 of 495 customers able to restore
- Sourcenext discloses 22.52M records exposed via member-data API (Oct 9-13); Burger King Japan discloses 11.18M; Qilin claims Keio Corporation
- IPA opens special help desk; Yamato Transport (5.26M), Nikkei (1.83M) and E-Store/ShopServe (~23.36M) disclose
- GMO Cybersecurity by IERAE confirms ARTEX traces on infrastructure targeting ~20 Japanese companies (8 with disclosed breaches) and six other AI attack infrastructures; Ymirlink discloses ~9M records
- SOCRadar publishes analysis of the October 2026 Japan breach surge
Sources cited for Japan October 2026 Data Breach Surge
- Japan Data Breaches 2026: Inside the October Surge (SOCRadar)
- GMO Cybersecurity by IERAE: ARTEX AI attack findings
- ARTEX AI pentesting tool used in data breaches (The Hacker News)
- Hacker used ARTEX AI and Claude agents to target South Korean banks (BleepingComputer)
- Ransomware attack disrupts Japan's IDCF Cloud used by govt clients (BleepingComputer)
- IDC Frontier ransomware: 495 organizations affected (@IT)
- Sourcenext member data API unauthorized access (22.52M)
- Ymirlink breach disclosure (Internet Watch)
- NICT A2B (App-to-Backend) attack advisory
- IPA special help desk press release
- FSA ID image guidance
- Japan Threat Landscape Report 2026 (SOCRadar)
Detection coverage for TL-2026-3956
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3956 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.