JPCERT/CC warned on 8 October (updated 23 October) that unauthorised access leading to personal-data leaks has been hitting Japanese organisations since around September 2026. Information sharing is limited, so details are fragmentary, but three patterns stand out:
- Scanning for known vulnerabilities on each target — and taking advantage of management lapses such as exposed configuration or backup files.
- Abusing APIs: endpoints and keys extracted from public smartphone apps, internal APIs the UI never calls (privilege changes, rogue accounts), NoSQL injection to enumerate accounts, and API keys stolen from other breaches.
- Metabase SQL injection (CVE-2026-72898), exploited through crafted API requests.
None of these needs a zero-day: they work because something old, exposed or over-privileged was left reachable from the internet.
