Newsletter - September 2026
Cybersecurity Newsletter for September 2026
Japan’s latest cybersecurity incidents, vulnerabilities & research — in 2 minutes.
🚨 A Surge of Cyber Incidents in Japan
September was an unusually busy month for cybersecurity incidents in Japan.
One Japanese incident tracker recorded 36 publicly disclosed cases during September, while an independent review identified 29 confirmed information-leakage or unauthorized-access cases. The concentration was particularly striking at the end of the month: 10 of 16 major cases reviewed were announced or updated between September 25 and 30.
The affected organizations ranged from car-sharing and convenience stores to railways, logistics, government infrastructure and major online services.
🚗 Times Car — approximately 6.6 million accounts affected
Park24’s Times Car disclosed unauthorized access to its web system. Approximately 6.6 million customer accounts were affected, with approximately 1.6 million cases involving identity-verification documents confirmed as leaked.
The incident is particularly significant because the exposed information included highly sensitive identity-related data.
📖 Read more
🖼️ Gyazo — 23.62 million user records exposed
Image-sharing service Gyazo, operated by Helpfeel, suffered unauthorized access. Information relating to approximately 23.62 million users was externally exposed.
The incident also involved metadata for approximately 490 million images, including information such as image IDs, IP addresses, User-Agent data and, where present, EXIF location information.
A later investigation found metadata relating to approximately 174 million deleted images had also been exposed.
📖 Read more
🚆 Keio Railway — ransomware attack
Keio Railway confirmed a ransomware attack against servers used by the group. Some group companies experienced disruption to business systems.
At the time of the initial announcement, railway operations were not affected, and the company had not confirmed information leakage.
📖 Read more
🏪 Seicomart — approximately 570,000 accounts potentially affected
Seicomart reported unauthorized access through its mobile-app infrastructure to a server containing customer information. Approximately 570,000 accounts may have been affected.
Names, addresses, telephone numbers and email addresses were among the information potentially accessible. Passwords and purchase histories were not affected according to the company’s announcement.
📖 Read more
🚇 Tokyo Metro — approximately 59,000 email addresses
Tokyo Metro reported unauthorized access to a server used by its Metro Point Club (Metpo) email service. Approximately 59,000 email addresses may have been viewed or obtained.
The company said other membership information was not stored on the affected server and continued investigating the incident.
📖 Read more
📦 Nichirei — approximately 50,000 records confirmed leaked
The Nichirei incident continued to develop in September. The company confirmed that personal information stored on compromised servers had been leaked.
The affected data included 3,308 records relating to delivery recipients, 6,849 records relating to business partners, and 43,709 records relating to employees, families and job applicants — approximately 53,866 records in total.
📖 Read more
🔎 Other Incidents Worth Watching
🏛️ Government Solution Service (GSS)
A vulnerability in a VPN device was exploited to gain unauthorized access to Japan’s Government Solution Service (GSS). Approximately 246,000 records may have been affected.
📖 Read more: Security NEXT
🛒 MURAUCHI.com
Approximately 7.72 million records were confirmed to have been taken externally following unauthorized access.
📖 Read more: Security NEXT
🏨 OZmall
Up to approximately 448,000 personal records may have been exposed.
📱 Rohto Pharmaceutical
Unauthorized access to its e-commerce system potentially exposed customer call-recording data.
These incidents illustrate that September’s activity was not concentrated in one sector or attack type.
📈 What September Tells Us
The September data does not by itself prove that the underlying attack rate suddenly increased. Public disclosure counts are affected by detection, investigation time, disclosure policies and the number of follow-up reports.
However, the volume and concentration of disclosures were clearly notable. Several of the month’s largest incidents involved externally accessible systems, web applications, VPN infrastructure, third-party services or stolen credentials. One analysis of 29 September cases found that, among the 10 cases where the cause had been publicly established, six involved exploitation of vulnerabilities.
For organizations, the message is straightforward:
Your internet-facing attack surface remains the highest-priority battleground.
🐞 Vulnerability Watch
September brought several high-priority vulnerability updates affecting products widely used by organizations, including:
- Microsoft products — September security updates
- Adobe Acrobat / Reader
- Next.js ImageResponse — vulnerability potentially leading to remote code execution
- ServiceNow AI Platform — multiple vulnerabilities including SQL injection
- Cisco products
- Check Point products
- Fortinet products
- GitLab
- Chrome / Edge
IPA classified the September Microsoft update as “Emergency”, noting that some vulnerabilities were already being exploited.
📖 Read more
👨💻 For Bug Bounty Hunters
September’s incidents reinforce one lesson: look beyond the obvious target.
The month’s major incidents repeatedly involved:
🌐 Internet-facing applications
🔑 Authentication and credentials
🛡️ VPN and remote-access infrastructure
☁️ Cloud and third-party services
📤 File-upload and management interfaces
For bug bounty researchers, this means that finding the vulnerability is only the beginning. Understanding how an exposed component connects to sensitive data, privileged functionality and other systems is where high-impact findings often emerge.
🎯 Research opportunities
When testing within program scope, consider:
- Authentication and authorization boundaries
- Exposed administrative functionality
- File-upload and processing pipelines
- Third-party integrations
- API-to-backend trust relationships
- Cloud and storage configuration
- Vulnerable components and outdated dependencies
The September incidents show why attack-surface mapping and vulnerability chaining remain valuable skills—even as AI increasingly automates reconnaissance and basic vulnerability discovery.
💡 Security Tip
Don’t wait for an incident to discover what is exposed.
Maintain an accurate inventory of internet-facing applications, APIs, VPNs, cloud services, third-party integrations and privileged accounts. Prioritize vulnerabilities affecting those systems and verify that security fixes are actually deployed.
🚀 BBHunt Japan
EN: BBHunt Japan connects Japanese organizations with ethical hackers to discover vulnerabilities before attackers do.
More cybersecurity news next month.