Japan’s Cyberattack Surge Tests Its Push to Strengthen Defenses

Japan is facing an intense wave of AI-powered cyberattacks that’s laid bare the vulnerability of one of the world’s largest economies to a new breed of hacking.

Dozens of incidents affecting companies from brokerages to delivery firms have made data leaks a regular part of life in the country. On Wednesday, the government said an official website for electricity and gas trading information was breached, days after hackers claimed they published a trove of sensitive customer information from the currency trading platform GMO Internet Group Inc.

The events followed a rush last week by governments and companies to protect themselves from vulnerabilities in a common programming language known as PHP were revealed, leading companies like Mizuho Financial Group Inc. to roll out emergency measures.

The wave of cyberattacks comes with high stakes because Japan’s industrial conglomerates are key links in the global technology supply chain and the country boasts the world’s second-largest savings pool, all of which are attractive targets for hackers. The crisis is also forcing Prime Minister Sanae Takaichi to accelerate plans to bring Japan’s cybersecurity up to the levels of its peers, part of her agenda of making the nation more resilient to external threats.

Japanese Prime Minister Sanae Takaichi; photo credit: Rie Kikuchi/AFP/Bloomberg

Japan is experiencing an unusually dramatic uptick in cybercrime this year, said Tom Kellermann, Vice-President of AI Security and Threat Research at TrendAI, a unit of Trend Micro Inc. Many of the attacks can be attributed to prominent Russian-speaking cybercriminal groups such as LockBit and Qilin, which are suspected to be collaborating with North Korean hackers in some instances, he said.

Experts say the advent of AI agents and open-source hacking tools has made it easier than ever for criminal groups to take advantage of Japan’s outdated infrastructure and overcome the Japanese language barrier. Hackers are using AI to augment their abilities, deploying the technology to analyze complex networks and find vulnerable targets, deliver capabilities and evade detection, according to Kellermann.

An AI tool developed in China to test cyberdefenses known as ARTEX has been linked to many recent attacks, according to Daiki Fukumori, director of cybercrime countermeasures center at GMO Cybersecurity by Ierae Inc. The same tool was linked to a rash of breaches at South Korean banks last month.

The spate of attacks has led to a shift in Japan’s cybersecurity, resulting in concerns about widespread risks, according to Yutaka Sejiyama, deputy director of the Macnica Security Research Center, an independent think-tank. “Hackers are indiscriminately attacking publicly accessible web systems, particularly those that handle personal data,” Sejiyama said. “They are stealing whatever information they can obtain from vulnerable websites.”

Japan’s exposure to cyber threats has long been an issue of anxiety. Last year, a crippling ransomware attack halted operations at Asahi Group Holdings Ltd. Askul Corp. also suffered a breach that disrupted its e-commerce platform. In 2020, Chinese military hackers infiltrated Japan’s defense networks without Tokyo’s awareness, and US government officials later flew to Tokyo to alert their Japanese counterparts of the breach, according to the Washington Post.

However, experts say the recent hacking barrage is unprecedented. At least 81 incidents have been reported in the country since July, comprising nearly a third of attacks in the last three years, according to Sejiyama.

The crisis comes after Takaichi elevated cybersecurity to a national priority in the summer, with a focus on safeguarding critical infrastructure. The country had been largely focused on post-incident investigation and response, but it’s now shifting to a more proactive stance of monitoring online communications traffic to identify potential threats and trying to neutralize them.

“We are much, much weaker than other G7 countries,” said Motohiro Tsuchiya, a professor at Keio University in Tokyo and member of an advisory panel to the Japanese government on cybersecurity, noting that the country is receiving training and advice from American, Australian and British security services.

A key reason Japan lags its peers in cybersecurity stems from constitutional and legal restrictions on government monitoring of communications, including from overseas, according to Tsuchiya. But those restrictions have been lifted by new legislation, some of which only took effect earlier this month.

Japan has committed additional funds toward cybersecurity but a lingering problem has been finding sufficient experienced manpower. “Developing and securing highly capable cybersecurity personnel is an urgent task if we are to respond to and deal with threats appropriately,” chief government spokesman Minoru Kihara said on Thursday.

Yoshiyuki Hanaya, of Osaka-based website development company ID-TECHS, said a sharp rise in AI-driven cyberattacks over the last six months. Last week, he raced back from a business trip to be ready when the PHP software patch dropped late at night. After that, he spent days dealing with client requests, he said.

“Other than eating, going to the bathroom, bathing and sleeping, I’ve basically been in front of my PC the entire time,” he said.

Japan also remains an attractive target for hackers because it’s home to a large number of small companies that are cash-rich and have inadequate IT security, according to Benjamin Bartlett, a professor at Miami University specializing in cybersecurity. During the current wave of attacks, most incidents have seen those types of companies targeted by financially motivated hackers, he said.

“Japanese companies are more of a bellwether for what is to come, rather than uniquely bad,” Bartlett said. “I don’t think anyone’s prepared for this.”

Photograph: The Tokyo Tower in Tokyo, Japan; photo credit: Shiho Fukada/Bloomberg

Related: