Newsletter - October 2026
Cybersecurity Newsletter for October 2026
Japan’s latest cybersecurity incidents, vulnerabilities & research — in 2 minutes.
🚨 The Breach Wave Continues
October kept the September wave going: 33 breach disclosures between Oct 6–19 alone (vs. 21 in the previous three weeks), affecting a cumulative maximum of ~130 million records. The defining pattern: one compromised platform or vendor cascaded into dozens of victim organizations — and authorities linked parts of the wave to AI-assisted attacks.
💻 SourceNext — 22.52M records incl. passwords
Attackers abused the member-data API to exfiltrate up to 22,519,960 records (emails, passwords, names, addresses, phone numbers). All users are asked to reset passwords and stop reusing them elsewhere.
☁️ IDCF Cloud — ransomware hits a cloud region
A ransomware attack on IDC Frontier’s IDCF Cloud (East Japan Region 1) disrupted 495 companies and municipalities. The company later reported no data exfiltration from affected VMs; JR East and View Card withdrew their initial leak reports.
📦 Yamato Transport — 5.31M records leaked
Unauthorized access to the Kuroneko Atobarai (deferred payment) service leaked 5.31 million records (names, addresses, phone numbers).
✈️ skyticket — 14.64M records, three intrusions
Three separate incidents: 14.64M customer records leaked (incl. hashed passwords for 4.13M), plus refund bank details and an unauthenticated booking page. A later report added card data for up to 6,140 people.
🏛️ Arcadia “SpeeCAN RAIDEN” — disaster-alert platform breached
The municipal disaster-alert service was breached, leaking registered personal data across many local governments. Reports also indicate ~125,000 police officers and staff at 20 prefectural forces may be affected.
🔎 Other Incidents
- 🍔 Burger King Japan — up to 11.18M app accounts
- 👥 Commune — ~307K records via a platform flaw; LINE Yahoo, Aomori Pref. and others affected
- 📚 Book Off — 6.38M records (incl. password hashes)
- 🎤 Daiichi Kousho (Big Echo) — 8.72M records via an infected contractor PC
- 🍣 Ride On Express (Gin no Sara) — up to 6.5M records via ransomware at server operator
- 💼 Dip (Baitoru) — 3.89M emails via a specification flaw
- 📮 Yumilink — ~9M records via email-delivery systems
📖 SQ Magazine / The Japan Times
📈 What October Tells Us
Disclosure counts alone don’t prove attacks increased — but three trends are clear:
1️⃣ Cascade effects are the norm — one vendor flaw became a mass incident (Arcadia, Commune, IDC Frontier). 2️⃣ APIs and business logic are the front door — API abuse, invite-link flaws, unauthenticated pages. 3️⃣ AI-assisted attacks have arrived — JPCERT/CC confirmed AI-driven scanning and API attacks.
Japan’s mandatory incident reporting took effect Oct 1; IPA, JPCERT/CC and Gartner issued urgent guidance.
One vendor’s flaw is now a hundred organizations’ incident.
🐞 Vulnerability Watch
- Microsoft — Oct 2026 Patch Tuesday: record 1,400+ vulns, incl. exploited Windows Shell zero-day (CVE-2026-96951)
- PHP — CVE-2026-109618 / 109619: multiple vulns, exploitation reported
- IPA / National Cybersecurity Office (Oct 9): urgent measures for all organizations
📖 EN: SecurityWeek / CrowdStrike
👨💻 For Bug Bounty Hunters
The API is the target — the mobile app is the map.
JPCERT/CC found attackers reverse-engineering APKs (jadx, Blutter) to extract secrets and API signing logic, then calling APIs directly with custom clients.
🔎 Where this month’s bugs were:
- Object-level authz (IDOR) on member APIs
- Invite/role logic flaws
- Unauthenticated pages in flows
- Embedded secrets in apps
- SSRF in URL-fetch features
AI accelerates recon — but impact still comes from how functionality, data and trust connect.
💡 Security Tip
Treat every API as public. Enforce server-side auth on every endpoint, never rely on app-embedded secrets, apply rate limits to data-retrieval APIs — and when a vendor says reset your password, do it now and never reuse it.
🚀 BBHunt Japan
BBHunt Japan connects Japanese organizations with ethical hackers to discover vulnerabilities before attackers do.
More cybersecurity news next month.