TOKYO - A series of cyberattacks has exposed millions of personal records belonging to customers of major Japanese companies, including Muji, Matsuya and All Nippon Airways, as well as individuals connected to the Foreign Ministry, while cybersecurity experts investigating a separate attack involving GMO say a serious mistake by the hackers may provide crucial clues to their identities.
Ryohin Keikaku, the operator of the Muji retail chain, announced that personal information associated with as many as 27.26 million accounts may have been compromised. The potentially exposed data includes email addresses registered through the company's official app, with the affected accounts also including those of former members who had canceled their registrations.
Beef bowl restaurant chain Matsuya also disclosed a data breach involving approximately 2.38 million registered users of its apps and other services. The leaked information includes names and telephone numbers, raising concerns about the potential misuse of customer data.
All Nippon Airways (ANA) reported that information belonging to approximately 37,800 passengers had been exposed, including names and reservation numbers. For about 1,700 of those passengers, the compromised information also included passport numbers, telephone numbers and nationalities.
The wave of data breaches has extended beyond private companies to government institutions. Japan's Foreign Ministry announced that personal information involving approximately 3,600 records may have been leaked, including email addresses and names.
Of those records, roughly 900 belonged to individuals who were not ministry employees, indicating that the potential breach extended to people outside the government organization.
The ministry said no secondary damage resulting from the incident had been confirmed as of its announcement.
As concerns grow over the repeated exposure of personal information, cybersecurity specialists investigating a separate attack involving GMO have identified what they describe as potentially significant evidence left behind by the perpetrators.
According to one expert, the attackers made a serious operational mistake by inadvertently making publicly accessible records showing who had visited their own extortion website.
Such websites are commonly used by cybercriminals to pressure victims into meeting demands, including threats to release stolen information. In the GMO case, however, records associated with the attackers' website may have become a valuable source of evidence for investigators.
The expert explained that the publicly exposed records included information about visitors' activity on the website, allowing analysts to examine patterns that could distinguish ordinary visitors from individuals involved in operating the site.
Particularly suspicious were several IP addresses associated with distinctive behavior immediately after files on the website had been edited or updated.
The timing suggested that individuals responsible for making changes to the website subsequently accessed it to check the results, inadvertently leaving digital traces of their activity.
An IP address functions as a network identifier and can provide investigators with clues about the origin of internet connections, although it does not necessarily identify the person using a particular connection.
By comparing the timing of website modifications with visitor activity, the expert said it had become possible to narrow down the addresses potentially associated with the attackers.
"After carefully examining the records, I strongly suspect that three IP addresses were used by the attackers," the expert said.
Another cybersecurity specialist working with GMO said an analysis of the records left by the hackers had already produced information about a person who could potentially be involved in the attack.
The specialist said the findings had been provided to GMO and included identifying information about the individual, such as a name, address and contact details.
Although the available evidence has not conclusively established the person's involvement, the discovery represents a possible breakthrough in efforts to identify those responsible.
The specialist suggested that the attackers may not have possessed the operational discipline normally associated with experienced cybercriminals, leaving behind information that could make them easier to trace.
"I don't think they are professionals in cybercrime, so I believe they have left behind a great deal of information that could be used to track them," the specialist said. "I think there is a fairly high possibility they will be caught."
The findings offer a potential lead in the GMO investigation as Japanese companies and government agencies face mounting pressure to strengthen cybersecurity and prevent the unauthorized disclosure of personal information.
With millions of customer records potentially affected across multiple organizations, the latest incidents have also highlighted the risks of storing large volumes of personal information in interconnected digital services, where security breaches can expose data ranging from basic contact details to sensitive travel documents.
Source: TBS
