By The Straits Times | Created at 2026-10-16 13:51:11 | Updated at 2026-10-16 14:34:32
49 minutes ago
TOKYO/SEOUL – A relentless wave of cyberattacks is smothering Japan and South Korea, leaking tens of millions of personal records and exposing an urgent need to strengthen digital security to protect consumer privacy.
In Tokyo, Masaaki Taira, who chairs the ruling Liberal Democratic Party’s cybersecurity apparatus, on Oct 9 framed the escalation as a “national cyberspace emergency”.
Days earlier in Seoul, South Korean President Lee Jae Myung warned that artificial intelligence is dramatically lowering technical barriers, allowing amateur hackers to “use AI to breach systems with ease even without specialised skills”.
While both countries have enacted new laws in response to recent breaches, they appear to be inadequate to counter growing threats caused by AI especially when the hackers originate from abroad and target corporate entities.
Cybersecurity experts told The Straits Times that the current spate of attacks is primarily financially motivated. Criminals deploy commercial AI models and penetration tools to automate target discovery and execute breaches at unprecedented speed.
“Recent incidents appear to involve advanced AI technology systematically scanning for vulnerabilities and exploiting them to gain unauthorised access,” said Harumichi Yuasa, Dean of the Graduate School of Governance at Meiji University.
“While there is, at present, no evidence suggesting direct nation-state involvement, attackers are aggressively targeting entities holding vast stores of personal data to sell on underground markets for quick financial gain,” he added.
Kim Seung-joo, a professor at Korea University’s School of Cybersecurity, concurred that AI has slashed the time needed to find system vulnerabilities.
“Systems that have traditionally remained overlooked or poorly managed may become increasingly vulnerable as AI makes it easier for attackers to identify and exploit security blind spots,” he said.
He added that Japan and South Korea are prime targets due to their hyper-digitised economies and “high concentration of corporate targets with deep financial resources”.
The attacks have primarily manifested in two forms: destructive ransomware that locks computer networks until a ransom is made, and unauthorised network intrusions designed to siphon private customer records.
Ransomware attacks can paralyse entire supply chains. Tech conglomerate SoftBank’s subsidiary IDC Frontier, a cloud computing and data centre services provider, said on Oct 7 that one such attack on its cloud system had disabled services for 495 corporate and municipal clients. The outage not only forced frozen food distributor Nissui to freeze shipments to 1,200 business partners, but also knocked out websites for Ibaraki Prefecture and its police headquarters.
Concurrently, unauthorised network access leading to data theft has surged. In Japan, over 600 corporate cyber incidents were reported by early October 2026, already surpassing the total recorded in all of 2025.
One major vulnerability highlighted by recent breaches is the reliance on third-party vendors and shared cloud infrastructure, with attackers exploiting a single vendor to compromise dozens of major corporations simultaneously.
Such integration, said Nomura Research Institute executive economist Takahide Kiuchi, means that internal security is no longer enough.
“Companies must identify single points of failure across outsourced services, such as logistics and cloud services, and build continuity plans that include strict access controls for external partners,” he said.
Like the IDC Frontier breach, other recent incidents illustrate the cascading impact of these supply-chain intrusions.
A security compromise at IT vendor Scala Communications exposed customer records across client companies, including 220,000 records at Daiwa Securities and 100,000 at Citizen Watch.
An intrusion at vendor Arcadia Inc affected nearly 800 entities – including at least 111 municipalities that rely on its emergency disaster alert systems. In response, Internal Affairs Minister Hisayuki Fujii said on Oct 16 that local governments must “secure multiple means of transmitting disaster information to avoid reliance on one single provider”.
The amount of consumer data compromised across Japanese retail, transport and service sectors has reached staggering numbers, with individual companies also having been affected.
Among the worst-hit are software firm SOURCENEXT (22.51 million customer records), travel booking site Skyticket (14.64 million), Burger King (11.18 million), grilled meat chain Yakiniku King (10.78 million), karaoke operator Big Echo (8.72 million), transport operator JR East (6.09 million) and convenience store giant Lawson (2.15 million).
And in one day on Oct 16 alone, companies that reported leaks include delivery firm Yamato (5.3 million), media organisation Nikkei (1.83 million), car repair firm Yellow Hat (1.8 million) and cosmetics brand FANCL (780,000).
What was arguably the most alarming breach in Japan in recent weeks was one affecting Park24’s Times Car rental service, which led to the images of 1.6 million driver’s licences being sold on the dark web for as little as 20 yen (15 Singapore cents) each, triggering fears of widespread identity theft.
Even where credit cards or passwords remain secure, experts warn that stolen personal details, such as names, physical addresses, email addresses, phone numbers and birth dates, can be harvested for targeted phishing scams.
Yuasa described the ongoing crisis as a digital “game of whack-a-mole”.
“Closing one security gap often means an attack emerges elsewhere,” he noted, citing a growing corporate reliance on cloud services as one such gap.
“It is now nearly impossible to prevent all security incidents through preemptive measures alone; consequently, post-incident response has become increasingly critical,” he said.
Over in South Korea, cybercriminals have successfully targeted major financial institutions and religious bodies.
On Oct 7, megachurches Yoido Full Gospel Church and SaRang Church confirmed they were investigating breaches that exposed hundreds of thousands of congregant records, including sensitive tithe and donation histories.
Between late September and early October, at least 16 financial institutions, including major lenders Shinhan Bank and KB Kookmin Bank, were hit by intrusions exposing roughly 100,000 customer contact and borrowing records. But account passwords, credit card numbers, and transaction histories were not compromised.
Cybersecurity firm CrowdStrike tied the South Korean banking intrusions to a Chinese-speaking threat actor who used ARTEX – an open-source, AI-driven penetration tool developed in China – alongside large language models to automate vulnerability scanning.
In response, South Korea’s Financial Services Commission held an emergency cybersecurity meeting, directing financial institutions to block suspected malicious IP addresses, issue emergency patches and temporarily isolate compromised systems.
The recent wave of breaches comes despite past high-profile cyber incidents that led both nations to tighten legal frameworks.
In South Korea, a historic leak in April 2025 exposed 23.24 million SK Telecom subscriber records, followed by a breach affecting 33.7 million accounts at e-commerce giant Coupang in November 2025.
These intrusions prompted Seoul to tighten its personal data protection framework on Sept 11, introducing fines of up to 10 per cent of a company’s total revenues for severe, repeated, or negligent violations.
In Japan, a 2023 ransomware attack shut down the Port of Nagoya for 2½ days, while a 2025 breach at beverage giant Asahi Group Holdings took six months to fully resolve.
In response, Tokyo enacted “active cyber-defence” laws on Oct 1, authorising the government, police and Self-Defense Forces to monitor network traffic for compromise and preemptively neutralise hostile foreign servers if 15 designated critical infrastructure sectors, such as power, gas, and transport, come under attack.
But the law sets a high legal bar and is targeted at state-sponsored infrastructure sabotage to deter “grey zone” hybrid warfare. Ordinary criminal breaches targeting commercial firms represent “illegal activity” that currently falls outside its scope.
Given the accelerating threat posed by AI, Yuasa suggested that there may be “future discussions on whether the threshold to invoke active cyber defence should be lowered”.
South Korea, for its part, is pursuing a shift towards a more risk-based approach to cybersecurity and taking measures to enable wider adoption of AI technologies to detect threats and automate responses.
“This will not only improve operational efficiency but also provide an important foundation for building more intelligent cybersecurity defence systems,” said Kim.
