TOKYO - A growing wave of cyberattacks across Japan has raised concerns over the possible use of Chinese-developed artificial intelligence in hacking operations, with personal information belonging to tens of thousands of police employees potentially exposed and major companies forced to suspend online services, while cybersecurity experts warn that slow decision-making within Japanese organizations is allowing damage to spread.
The latest incidents have raised concerns about Japan's ability to respond to rapidly evolving cyber threats, particularly as artificial intelligence makes it easier for attackers to identify vulnerabilities, steal sensitive information and operate across language barriers.
Saitama Prefectural Police announced on October 21 that personal information belonging to all 13,000 employees may have been leaked following unauthorized access to a company contracted to operate its systems. Kanagawa Prefectural Police also revealed that information concerning approximately 16,000 employees may have been compromised.
Police organizations in Aichi, Fukuoka, Tochigi and Gunma prefectures are also among those potentially affected. The incidents are linked to unauthorized access to a company operating a disaster prevention information distribution service that had been entrusted with managing systems for the police.
The compromised information may include the names, departmental affiliations and email addresses of police officers and administrative employees. Some prefectural police organizations face the possibility of having information concerning more than 10,000 personnel exposed.
Cyberattacks have also reached central government programs. According to the Ministry of Land, Infrastructure, Transport and Tourism, unauthorized access to the administrative office of the Housing Energy Saving 2024 Campaign may have resulted in the leakage of personal information belonging to approximately 24,000 people.
The government campaign provides subsidies for energy-efficient housing renovations and other measures designed to improve residential energy performance.
In another major incident, the operator of Furusato Choice, a platform supporting Japan's hometown tax donation system, announced that approximately 4.45 million personal information records had been leaked.
The confirmed leaked information includes names, addresses and estimated tax deduction amounts associated with donations, raising concerns about the exposure of financial and personal details held by online service providers.
The attacks have also disrupted commercial services. On October 21, the company operating the Second Street and GEO retail chains suspended online shopping and other services, while SoftBank's customer account website, My SoftBank, remained inaccessible.
As the number of incidents grows, cybersecurity researchers have identified a potentially significant development: the use of AI agents capable of conducting cyberattacks with limited human intervention.
An investigation by a subsidiary of GMO Internet Group found indications that an AI agent called ARTEX, publicly released by a Chinese developer, had been used in some cyberattacks.
Researchers believe the technology may have been involved in attacks targeting approximately 80 Japanese companies, suggesting that AI-assisted hacking could become an increasingly serious threat to corporate security.
To demonstrate the technology's capabilities, Tokyo-based cybersecurity company S&J conducted a simulated attack using ARTEX.
Although the AI agent's interface displayed Chinese text, the operator was able to issue instructions in Japanese.
"All we had to do was give it three lines of instructions in Japanese, telling it what to do against the target. Once those instructions were entered, it began the attack," said Nobuo Miwa, president of S&J.
One of ARTEX's distinguishing features is its ability to consult other AI systems for assistance, obtain possible solutions and identify suitable attack methods without requiring a human operator to manage every step.
During the demonstration, the system proceeded automatically, reporting that the operation was progressing successfully.
The simulated attack was completed in approximately three minutes.
"When we opened the files it had actually retrieved, there were email addresses and passwords. Doing the same work manually would take considerable time," Miwa said.
The demonstration highlighted the potential for AI agents to automate tasks that previously required significant technical knowledge and time, making sophisticated cyberattacks easier to conduct.
Researchers also suspect ARTEX was used in a series of cyberattacks against financial institutions in South Korea beginning in September. Those incidents reportedly resulted in the leakage of personal information belonging to more than 60,000 people.
The suspected use of the same technology in both Japan and South Korea has raised concerns that AI-assisted cybercrime could spread across borders, particularly as attackers gain access to tools capable of operating in multiple languages.
John Hultquist, who leads a team analyzing cyber threats at Google, warned that ARTEX represents part of a broader shift toward automated hacking.
"It is a tool we have been seeing quite frequently recently," Hultquist said. "Eventually, the combination of these tools will make it easier for all types of attackers to improve the level of their operations. That means we will face faster, large-scale attacks in the near future."
Hultquist noted that the number of cyberattacks in the United States has reached a plateau, suggesting that attackers are increasingly looking for new targets elsewhere.
Advances in artificial intelligence have made it easier for cybercriminals to operate across language barriers, potentially increasing threats to countries outside the English-speaking world, including Japan.
"We have identified numerous phishing kits designed to target Japanese people," Hultquist said. "Many of these fraudulent tools are circulating through Chinese-language underground communities, and that activity is showing signs of increasing."
Phishing kits are collections of tools used to create fraudulent websites and messages designed to trick people into revealing passwords, account details and other sensitive information.
The ability of AI systems to generate convincing messages in different languages could make such attacks more effective against Japanese individuals and organizations that were previously less accessible to foreign-language cybercriminals.
While new technologies are expanding the capabilities of attackers, cybersecurity specialists say Japanese companies face a separate challenge in how they organize their defenses and respond to emergencies.
At Cyber Gym, a cybersecurity training facility in Tokyo, demand has surged among corporate security personnel seeking practical experience in handling real-world attacks.
During one training exercise, simulated hackers exploited system vulnerabilities and began gaining control of individual computers. Skull symbols appeared on monitors as each machine was compromised, illustrating how an intrusion could spread through an organization's network.
Participants attempted to develop countermeasures as new attacks emerged.
One participant reported that two additional attacks had been detected, while another discovered that antivirus software had been removed without authorization.
As the exercise continued, the number of compromised computers increased rapidly. Eventually, nearly every computer in the simulated network had been hacked, leaving the system effectively under the attackers' control.
The training demonstrated how delays in responding to an intrusion can allow damage to spread, particularly when security teams struggle to identify the appropriate measures or obtain approval to implement them.
A corporate security officer who traveled from Kyushu to participate said the experience showed how quickly an organization could lose control of its systems.
"It was frightening to see how unauthorized access could occur without us realizing it, leaving computers completely unusable," the participant said.
Instructors identified two major weaknesses affecting Japanese corporate cybersecurity: shortages of qualified personnel and slow decision-making during emergencies.
Even when an attack is detected, delays in authorizing emergency measures can allow hackers to move through networks, disable security software and compromise additional systems.
Yosuke Asaka of VLC Security Arena said Japanese organizations frequently find themselves reacting too slowly compared with their international counterparts.
"Compared with the rest of the world, Japan inevitably tends to find itself reacting too late," Asaka said. "Going forward, we need to address the problem starting with the way organizations themselves are structured."
The concern is that traditional corporate decision-making processes may be poorly suited to responding to AI-assisted attacks capable of completing complex operations within minutes.
As attackers increasingly automate their activities, businesses may have less time to identify intrusions, isolate compromised systems and prevent the theft of sensitive information.
The incidents involving police departments, national government programs, telecommunications services and online retailers illustrate the range of organizations now exposed to cybersecurity threats.
They also highlight how a breach at a single outsourced service provider can potentially affect multiple public institutions that depend on its systems.
Cybersecurity experts say stronger technical safeguards alone may not be sufficient unless organizations also improve staffing, establish clear emergency authority and develop procedures for making rapid decisions during an attack.
Hultquist warned that the current developments may represent only the beginning of a much more serious wave of AI-enabled cybercrime.
"We are fortunate to be confronting this situation now, because this is only the beginning," he said. "It gives us an opportunity to get ahead of a threat that will become even more serious in the future."
Source: TBS
