Japan has just published the clearest picture yet of a breach wave that doesn’t announce itself with a ransom note.

On 8 October, JPCERT/CC issued an alert about a run of personal-data leaks from Japanese organisations since around September 2026. It says these are separate from the usual ransomware incidents, that they lead to large volumes of personal data leaking, and that they may be increasing. The companies hit are household names. Park24 disclosed that data on about 6.6 million Times Car accounts was taken, then said the next day that identity documents such as driver’s licence images had leaked from about 1.6 million of those accounts. Monogatari Corporation said 10,788,963 members’ details leaked from its Yakiniku King app’s member system. At the time, both companies said the cause was still under investigation.

This isn’t ransomware, and that’s what makes it dangerous. JPCERT/CC describes three patterns. In the first, attackers scan each target for a range of known flaws, or for basic mismanagement such as exposed configuration and backup files. In the second, they abuse the management APIs behind apps. They analyse a public smartphone app to pull out its endpoints and keys, attack internal APIs the app’s screens never call (changing privileges, creating rogue accounts, blind NoSQL injection), and reuse API keys stolen elsewhere. The third is CVE-2026-72898, a CVSS 10.0 SQL injection in the BI tool Metabase that needs no account and can lead to admin access and the stored credentials for connected databases. The uncomfortable part is that some of the systems hit, like BI tools and employee admin portals, were never designed for access by the general public. JPCERT/CC also calls what is known so far “limited and fragmentary”, because victims have shared little technical detail.

What security leaders should do:

• Inventory every API and management endpoint, including the ones your app UI never calls. Then test access as an anonymous user, not a logged-in one.
• Rate-limit APIs, especially login, password reset, SMS and search. Give tokens only the privileges they need, set expiry dates, and make sure you can revoke them quickly.
• Patch Metabase now. Upgrade to Metabase’s current minimum safe release (e.g. 0.63.13 / 0.62.16 / 0.58.31), not just the release that first fixed the CVE (0.63.5 / 0.62.9 / 0.58.24). “We patched” can still leave you exposed.
• Treat POST /api/session/reset_password returning 400 followed by GET /api/user/current returning 200 as a likely compromise.
• If that endpoint was internet-facing, revoke all sessions, review API keys and admin accounts, and rotate credentials for every connected database.

“Nobody knows that URL” is not an access control. Hidden endpoints stay hidden only until someone decides to look, and someone is looking.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#DataProtection #CyberSecurity #APAC #IdentitySecurity #ThreatIntel

Sources: JPCERT/CC alert, 8 Oct 2026 (Japanese) · JPCERT/CC Metabase CVE-2026-72898 alert, 14 Aug 2026 · Metabase security update · Metabase minimum safe releases · NVD CVE-2026-72898 · Park24, 28 Sep · Park24, 29 Sep · Monogatari Corporation (Yakiniku King) · The Hacker News