Eleven Japanese agencies issue warnings in a week over data leak wave

A compilation by Piyolog dated 11 October shows that at least 11 bodies issued separate warnings about the same wave of leaks between 2 and 9 October. They include the Personal Information Protection Commission on 7 October, JPCERT/CC and the National Police Agency on 8 October, and the National Cybersecurity Office, METI, IPA and the FSA on 9 October. The warnings share a common thread. The attacks target not core systems but internet-facing applications, APIs (the interfaces through which software exchanges data) and admin panels.

The FSA's 9 October notice covers banks, brokers, insurers, crypto-asset firms and money transfer companies. The agency warned that leaked document images could be used to open accounts in other people's names, and asked firms to audit their third-party risk management as well. Anti-money laundering rules already end image-based identity verification on 1 April 2027; the FSA wants firms to act before then. Jiji reports that Minister Satsuki Katayama on 9 October called IC chip reading an extremely effective method against fraud.

The warning rests on a concrete stockpile of data. According to Park24's third disclosure on 29 September, images of driving licences, proof-of-address documents or student cards for about 1.6 million accounts leaked in the Times Car breach. Rocket Boys reported on 10 October that at least 16 prefectures are reissuing licences with new numbers to those affected; Fukuoka had received 120 applications by 8 October. A new licence changes the number and photo, but name, address and date of birth stay the same.

Official figures cited by Piyolog show the wave growing in records per incident rather than in the number of reports. Notifications of malicious leaks totalled 7,604 in fiscal 2024 and 3,822 in fiscal 2025. The same compilation found no trace as of 9 October that conclusively showed AI being used in the attacks.