Why Japan's Data Breaches Are Spiking — And What AI Has to Do With It

The September Wave

Since late September, a string of Japanese companies have gone public with data breaches — each one larger, more personal, and more visible than the last. Times Car Share disclosed that driver’s license images had been exfiltrated. Yakiniku King, a major grill-restaurant chain, revealed over 10 million customer records were leaked. The list keeps growing.

On social media, two theories gained traction fast. One: generative AI has made attacks easier, turning casual actors into sophisticated threat operators. Two: some companies may be riding the coattails of earlier announcements, releasing their own breach notices simply because the news cycle was already hot.

Both explanations are tempting. Neither has been confirmed.

What the Experts Actually Say

Hiroaki Kuramochi, CTO and senior managing officer at Japanese security firm LAC, offered the clearest public assessment so far. His conclusion is sobering and more useful than either conspiracy theory.

Kuramochi does not believe the evidence yet supports a single attacker or a coordinated campaign. The breaches differ in target industry, intrusion vector, system compromised, scope of damage, and type of data stolen. Announcements clustered around late September, yes — but that likely reflects when companies finished their internal investigations and chose to disclose, not when the attacks occurred.

That distinction matters. A press-release timeline is not an attack timeline.

What Kuramochi sees instead is a structural pattern. Attackers are hitting the same kind of target — widely used consumer web services, mobile apps, and multi-tenant SaaS platforms — because those platforms concentrate enormous volumes of personal data in single points of failure. The efficiency gain for attackers is enormous: compromise one shared infrastructure layer and walk away with data spanning thousands or millions of users across multiple companies.

The Real Target Is Combination

Here is what makes these breaches strategically different from older, simpler thefts. Attackers are no longer content stealing just credit-card numbers or login credentials. They are collecting layers of identity data and stitching them together.

Driver’s license photos and license numbers — hard-to-change government-issued identifiers. Booking histories, travel itineraries, refund requests — recent behavioral data that reveals where people are and what they do. Bulk姓名、住所、連絡先 — basic personal details obtained from one platform and enriching attacks on another.

Combine these and the resulting profile is powerful. It enables fraudulent identity verification that passes basic checks. It enables phishing messages specific enough to bypass skepticism — references to a real hotel stay, a real purchase, a real name on a real license. The criminal value of a combined dataset far exceeds any single data type.

This is not a new tactic in isolation. But the convergence of multiple breach events in a short period, all hitting the same category of target with the same objective in mind, signals a deliberate strategic shift. Attackers are optimizing for data richness, not just data volume.

Where AI Fits — and Where It Doesn’t

The AI angle deserves scrutiny. Open-weight models like GLM-5.3 have demonstrated capabilities in vulnerability discovery and attack-code development in independent evaluations. Their weights are publicly available. Anyone can run them locally. That lowers the technical barrier for anyone with enough determination and baseline knowledge.

Kuramochi’s position is measured: there is no public evidence these models were used in the recent Japanese breaches. He is not ruling out the possibility, either. What he is flagging is the medium- to long-term trajectory. When advanced attack capability becomes runnable on commodity hardware, the ceiling for who can execute complex intrusions drops sharply.

The immediate breaches may predate widespread AI-assisted tooling. The next wave will not.

Who Wins, Who Loses

Consumers lose first. Every leaked driver’s license image, every exposed booking record, every combination of name-address-phone data is a permanent increment in personal risk. Unlike a password, you cannot change your face. Unlike a booking history, you cannot undo the fact that someone now knows where you stayed last March.

Platform operators lose second. SaaS providers and consumer app companies that treat security as a compliance checkbox rather than a core product attribute are sitting on concentrated data with inadequate defenses. The market is about to punish that calculation.

Attackers win by efficiency. They do not need to infiltrate dozens of individual companies. They need to find the one shared platform that serves them all. Each breach validates the strategy and refines the approach.

What Comes Next

Expect more disclosures. The September clustering was not the peak — it was the first visible release of pressure. Companies that discovered breaches earlier but took months to investigate will follow. Some will announce in stages rather than in a single press release.

Expect regulators to notice. Japan’s Personal Information Protection Commission has been quietly building enforcement capacity. A cluster of high-profile breaches affecting tens of millions of records will not go unanswered. New guidance on SaaS security expectations is likely.

Expect the conversation to shift from AI blame to architecture blame. AI made headlines because it is dramatic. But the real story is that millions of consumers voluntarily surrendered layered personal data to platforms that treated that data as a liability rather than a trust. The technology that enabled the breaches is less interesting than the business model that made them profitable.

Until that changes — until shared platforms are held to the same security standard as the data they hold — the next wave will look very similar to this one.

The only difference will be how much data is already in the wild.