# Japan October 2026 Data Breach Surge: Web/API Compromises, Supplier Breaches, IDC Frontier Ransomware and AI-Assisted Probing (ARTEX)

> At least 20 major Japanese companies disclosed breaches between late September and October 19, 2026, mostly via internet-facing web services, member apps/APIs, contractors and shared suppliers, alongside the IDC Frontier ransomware outage affecting 495 organizations. GMO Cybersecurity by IERAE confirmed traces of the Chinese-developed autonomous AI pentest tool ARTEX on attack infrastructure targeting about 20 Japanese companies, eight of which had disclosed breaches.

- **Published:** 2026-10-20T12:32:00Z
- **Last reviewed:** 2026-10-20T12:32:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3956
- **ID:** TL-2026-3956
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-55591

## Description

SOCRadar (2026-10-20) reports a surge of Japanese data-breach disclosures: 36 organizations issued first breach notices between Sep 25 and Oct 8, and 119 Japanese web compromises were tracked by Oct 6, 2026 versus 84 for all of 2025 (81 of the 119 after July). Largest disclosed exposures include Sourcenext (22.52M records via member-data API abuse, Oct 9-13), E-Store/ShopServe (~23.36M, May-Aug 2026 intrusion), skyticket (14.64M, admin function manipulation), Burger King Japan (11.18M, official app member system), Yakiniku King (10.79M, app member management system), Ymirlink (~9M records from 5 systems via a stolen support-staff login), Daiichikosho (8.72M, malware on a contractor PC), Times Car/Park24 (6.6M accounts and 1.6M ID images via a 20-year-old web system), Ride On Express (6.5M, ransomware at a hosting provider), Bookoff, Yamato Transport, Lawson, JR East, Nikkei (stolen credentials / development system), GMO Research (software vulnerability) and Daiwa Securities (contractor FAQ system admin login).

Supplier and shared-platform compromises created single points of failure: IDC Frontier's IDCF Cloud (East Japan Region 1) was hit by ransomware at 03:40 JST on Oct 7, 2026, taking 495 companies and local governments offline, including JR East email; a console message claimed 225 databases encrypted (3.6 PB), 239 hypervisors reached, 16,000 VM disks sealed and 554,153 snapshots wiped. By the 5th update (Oct 14) no data exfiltration evidence had been found and 194 of 495 customers could restore; the entry vector and ransomware family were not disclosed. Other supplier incidents: Scala Communications (FAQ platform exposing up to 5 clients including Daiwa Securities and Citizen Watch), Commune (communities run by Yamaha, Suzuki, Sansan, LINE Yahoo), and Studio (website builder cloud-environment feature flaw affecting Saitama Prefecture sites). SOCRadar names CVE-2024-55591 (FortiGate) among specific vulnerabilities and recommends reviewing FortiGate configurations and rotating VPN credentials.

On Oct 19, 2026 GMO Cybersecurity by IERAE reported confirming use of ARTEX, an autonomous LLM multi-agent penetration-testing system, from attack infrastructure targeting about 20 Japanese enterprises (9 in the same industry; 8 had already disclosed breaches). It also identified six further AI-based attack infrastructures with country- and industry-specific campaigns (retail/digital gifts, education/printing, marketing, insurance/finance, e-commerce/media/logistics, e-commerce). GMO published no IOCs and shared findings with law enforcement; the actor is not named. Separately, public reporting (CrowdStrike analysis via BleepingComputer/The Hacker News) ties ARTEX, developed by 'Autumn-27', to a financially motivated, likely Chinese-speaking operator who breached South Korean financial institutions (Shinhan Bank, KB Kookmin, Hana, BNK Busan, Yegaram Savings Bank) from late September to early October 2026 using DeepSeek v4.1-flash, GLM-5.3, Grok 4.6 and Claude Code sessions. The IP 38.244.50.120 and domain xcai.pro belong to that Korean campaign; no source ties them to the Japanese infrastructure. ARTEX's developer halted public releases on Oct 8 and went closed-source, though derivatives circulate. NICT (Oct 13) warned of A2B (App-to-Backend) attacks in which adversaries reverse-engineer public Android apps to map backend APIs and exploit server-side flaws, with AI making that analysis faster and cheaper.

Ransomware groups also posted Japanese victims in 2026: The Gentlemen (22), Qilin (14), Everest (9), Safepay (7), AiLock (5), Nightspire (5), Akira (4), LockBit5 (4), Metaencryptor (3). Qilin claimed Keio Corporation on Oct 15. Japanese authorities declared no state of emergency; IPA opened a special help desk on Oct 16 and the FSA requested IC-chip identity verification by April 1, 2027. Attribution of the Japanese breaches to a single actor is not established; the campaign is a cluster of independent incidents with a shared AI-assisted tooling thread.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.002 Tool
- T1583.003 Virtual Private Server
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1485 Data Destruction
- T1490 Inhibit System Recovery

## Sources

- [Japan Data Breaches 2026: Inside the October Surge (SOCRadar)](https://socradar.io/blog/japan-data-breaches-2026-inside-the-october-surge/)
- [GMO Cybersecurity by IERAE: ARTEX AI attack findings](https://gmo-cybersecurity.com/blog/20261019/)
- [ARTEX AI pentesting tool used in data breaches (The Hacker News)](https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html)
- [Hacker used ARTEX AI and Claude agents to target South Korean banks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/)
- [Ransomware attack disrupts Japan's IDCF Cloud used by govt clients (BleepingComputer)](https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/)
- [IDC Frontier ransomware: 495 organizations affected (@IT)](https://atmarkit.itmedia.co.jp/ait/spv/2610/09/news036.html)
- [Sourcenext member data API unauthorized access (22.52M)](https://rocket-boys.co.jp/security-measures-lab/sourcenext-member-data-api-unauthorized-access-22519960/)
- [Ymirlink breach disclosure (Internet Watch)](https://internet.watch.impress.co.jp/docs/news/2149476.html)
- [NICT A2B (App-to-Backend) attack advisory](https://kyodonewsprwire.jp/release/202610137756)
- [IPA special help desk press release](https://www.ipa.go.jp/pressrelease/2026/press20261016.html)
- [FSA ID image guidance](https://www.fsa.go.jp/news/r8/sonota/20261009/20261009.html)
- [Japan Threat Landscape Report 2026 (SOCRadar)](https://socradar.io/resources/report/japan-threat-landscape-report-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3956