TOKYO - Japanese companies are facing an increasingly serious wave of cyberattacks, with personal information leaks and fraudulent financial transactions causing widespread damage, while the rapid development of artificial intelligence is making attacks faster and more sophisticated and driving demand for cybersecurity specialists known as white hackers.
The growing threat was highlighted by a recent incident involving GMO Internet Group, whose foreign exchange trading service suffered unauthorized access in October, resulting in fraudulent transactions and financial losses for customers.
One affected customer said unauthorized trades were carried out between late October 21 and the early hours of October 22, initially causing losses of approximately 1.2 million yen.
"I honestly had no idea what was happening," the customer said.
The losses subsequently increased to nearly 2 million yen, leaving the customer struggling to sleep and concerned about the security of the account.
"I still don't feel reassured. I haven't been sleeping properly, and I just want things to settle down as soon as possible," the customer said.
Although various theories have emerged about the perpetrators, including speculation about possible North Korean involvement, the attackers have not been identified.
Cyberattacks are no longer confined to technology companies. Major restaurant chains, manufacturers, local governments and national government agencies have all become targets, demonstrating that organizations across virtually every industry and of every size face growing risks.
Between April and October this year, cyber incidents potentially exposed personal information covering a cumulative total of approximately 260 million individual records, including names, addresses, telephone numbers and credit card details.
The scale of the breaches has raised concerns about secondary damage, particularly phishing scams that exploit stolen personal information.
One consumer said suspicious messages claiming to concern personal information leaks had arrived several times, making it difficult to distinguish legitimate company notifications from fraudulent emails.
Others expressed frustration that companies sometimes failed to provide clear explanations about the consequences of breaches or the measures being taken to protect affected customers.
In response to the escalating threat, the Japanese government announced an emergency cybersecurity package worth 10 billion yen in early November, emphasizing the need to strengthen the country's overall defensive capabilities.
Private cybersecurity firms are also experiencing a sharp increase in demand as businesses seek protection against attacks that can occur at any hour.
At a security company in Tokyo, specialists monitor corporate networks around the clock, 365 days a year, looking for suspicious activity and investigating incidents when breaches occur.
The facility is divided into separate teams, with one responsible for continuous network surveillance and another investigating companies that have already experienced security incidents.
According to the company, the number of consultations from corporate clients has increased by 50% over the past three months.
Monitoring systems allow specialists to identify communications passing through corporate networks, determine which devices are involved and examine activity logs for signs of unauthorized access.
One of the most common forms of suspicious activity is reconnaissance, in which attackers systematically search networks and servers for vulnerabilities that could provide an entry point.
Attackers often scan publicly accessible systems, identify weaknesses and then attempt to exploit them before companies can respond.
A specialist at the security company demonstrated that a single server had received 1,023 connection attempts during the previous 24 hours, with some activity involving repeated attempts to guess passwords.
The specialist said scanning activity had risen steadily compared with a year earlier, with artificial intelligence playing a major role in accelerating attacks.
Previously, many cyberattacks required substantial manual work, limiting the number of targets criminals could pursue and the speed at which they could operate.
AI tools now allow attackers to automate much of the process, identify weaknesses more efficiently and conduct increasingly detailed investigations of potential targets.
"Previously, attackers had to do much of the work themselves, so there were limits to the scale and speed of their operations," the specialist said. "Now they can simply give instructions to AI, which can carry out attacks extremely quickly and examine even the smallest weaknesses. I think it will be very difficult to stop the increase."
As cyber threats evolve, companies in the Kansai region are also reassessing their security arrangements.
One company operating approximately 800 self-storage facilities nationwide, primarily in Kansai, recently sought professional advice on strengthening its defenses.
The business handles personal information belonging to around 20,000 customers across Japan, making the protection of its management systems a significant operational responsibility.
Company executives approached cybersecurity specialists to determine where improvements should begin and how information security should be incorporated into broader management decisions.
The specialists described their work as serving as the company's own white hackers, using techniques similar to those employed by malicious attackers to identify vulnerabilities before criminals can exploit them.
White hackers are cybersecurity professionals who use hacking skills for defensive purposes, including vulnerability assessments, penetration testing and identifying weaknesses in websites and computer networks.
During an initial examination of the storage company's website, a specialist demonstrated how information that ordinary users would rarely notice could be discovered through technical inspection.
By entering commands and examining information exposed by the website, the specialist located a login ID that could be identified from outside the company's systems.
Company representatives were surprised to discover that the information was accessible.
"Is that really the login ID?" one executive asked.
"Yes. With a little technical knowledge, someone outside the company can find it," the specialist replied. "After that, all they need is the password."
The specialist explained that an attacker who successfully obtained the password could potentially change or destroy information within the system.
Although the discovery did not mean an immediate intrusion was inevitable, the demonstration showed how seemingly minor weaknesses could create serious risks.
The specialist also warned that short passwords were particularly vulnerable to automated guessing attempts, noting that a six-character password could potentially be compromised very quickly if specifically targeted.
Passwords of eight characters or more could provide additional resistance, although the effectiveness of protection also depends on their complexity and the security measures surrounding the login system.
After the demonstration, the company decided to proceed with a more detailed vulnerability assessment and accelerate improvements to its cybersecurity defenses.
Executives acknowledged that their understanding of the threat had changed dramatically in a short period.
"The whole situation has changed in just a month," one executive said. "If there is something we can do, we have to do it."
The growing importance of white hackers has also attracted government attention, with authorities moving to recruit specialists and establish dedicated cybersecurity teams.
However, demand for such expertise is rising faster than the supply of trained professionals, creating concerns about a shortage of qualified personnel.
Educational institutions are responding by expanding cybersecurity training programs.
A vocational school in Osaka launched what it described as Japan's first specialized white-hacker course in 2019 and has since been training students to work in the rapidly developing field.
The curriculum begins with fundamental information technology skills before progressing to specialized cybersecurity training.
By their third year, students participate in simulated cyberattacks that reproduce attempts to infiltrate corporate systems, allowing them to study the techniques used by attackers.
They also learn to analyze networks, identify evidence of unauthorized access and investigate digital traces left behind during security incidents.
The training is designed to reproduce conditions encountered by cybersecurity professionals working in corporate environments.
This year, approximately 100 students across the school's first through fourth years are studying toward internationally recognized cybersecurity qualifications.
Some entered the program with little previous computer experience.
One student said the desire to pursue a career helping others had motivated the decision to study cybersecurity.
"When I first enrolled, I had hardly used a computer," the student said, explaining that the early stages of training involved arriving at school at 8 a.m. each day to practice typing.
Another student said an interest in website development during earlier university studies had led to a decision to specialize in cybersecurity.
As attacks spread across industries, educators and security professionals expect awareness of cybersecurity to increase among companies that previously considered it primarily a concern for technology businesses.
One instructor said recent incidents had demonstrated that cybersecurity expertise was necessary across a much wider range of industries.
Security specialists also warned that businesses could no longer assume they were adequately protected simply because they had installed conventional security software or outsourced their information technology operations.
Instead, companies need to examine their services regularly, identify vulnerabilities and make information security an ongoing management responsibility.
"Unless individual companies change their awareness and steadily check whether their services are properly protected, attackers will continue to exploit them," one specialist said.
Another warned that the growing sophistication of attacks could eventually make dedicated cybersecurity personnel essential for nearly every business.
"I think we are approaching an era when each company may need at least one person who specializes in cybersecurity," the specialist said.
White hackers and security engineers are expected to play an increasingly important role in protecting companies, public institutions and personal information as artificial intelligence continues to transform the capabilities of cybercriminals.
Yet the rapid growth in demand is creating a new challenge: ensuring that enough qualified specialists can be trained and recruited to keep pace with the evolving threat.
With attackers constantly searching for new vulnerabilities and defensive technologies struggling to keep up, Japan faces a prolonged battle to strengthen cybersecurity across its economy and public services.
Source: YOMIURI
