[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhmVFH3ZnNnu7xOPL3ff0en38yoSSKAo5EFTpu1-ywrU":3},{"article":4,"iocs":43,"watch_terms":62,"solutions":63,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"2e88b737-cb5a-4b81-bae3-e297da679842","Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks","japan-sees-sharp-rise-in-web-data-leaks-amid-mobile-api-abuse-and-metabase-attac-16fe04","Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT\u002FCC) said. The Tokyo-based center, which takes incident reports, based its October 8, 2026 alert on those reports and other information. The alert names no attacker and no affected organization. JPCERT\u002F","Japan's JPCERT\u002FCC has reported a significant increase in web data leaks, with attackers exploiting mobile app APIs and known vulnerabilities in software like Metabase. These incidents, distinct from ransomware, have led to the exposure of large volumes of personal data across various sectors, including online retail, member services, and business systems. Analysis indicates a sharp rise in such breaches since July 2026.","Japan reports a surge in web data leaks due to mobile API abuse and Metabase attacks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fjapan-sees-sharp-rise-in-web-data-leaks.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgCKjRUY0kVdYD5knK69g1IBPPL21WViperTcXNtjnWiYjNuL6GsohD9A6Q_SpyDpAT6mNMjLTZGOJ_eB1FIMUllxUVEnkUXA1zTWGU1aw5LYJrVZu5gNxH1zSpxX5elSBB-f2OG4LjdhzWTX97lT16uAdvKClT_gP4ucRJjKAXKU4a-3KxbbNLU5RdwKc\u002Fs1600\u002Fjapan.jpg","2026-10-08T15:45:56+00:00","2026-10-08T18:00:28.376291+00:00",7,[17,20,23],{"name":18,"type":19},"JPCERT\u002FCC","vendor",{"name":21,"type":22},"Metabase","product",{"name":24,"type":19},"Macnica","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":25,"icon":27,"name":28,"slug":29},null,"Breaches","breaches",[31,33,38],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48,50,52,54,56,58,60],{"type":45,"value":46,"context":47},"ip","103.105.192.18","Source IP address associated with attacks",{"type":45,"value":49,"context":47},"103.105.192.19",{"type":45,"value":51,"context":47},"103.105.192.20",{"type":45,"value":53,"context":47},"103.105.192.21",{"type":45,"value":55,"context":47},"103.105.192.22",{"type":45,"value":57,"context":47},"103.105.192.23",{"type":45,"value":59,"context":47},"103.105.192.24",{"type":45,"value":61,"context":47},"103.105.192.25",[18,24,21],{"controls":64,"vendors":149},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":95,"name":96,"problem":97,"products":98},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":124,"name":125,"problem":126,"products":127},"patch-management","Automated patch management","Known holes get closed in days, not months.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":145,"product_name":146,"url":147,"description":148},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":170},"api-abuse-and-unpatched-software-drive-japans-surge-in-web-data-leaks","API Abuse and Unpatched Software Drive Japan's Surge in Web Data Leaks","Attackers are exploiting both insecure mobile application APIs and known, unpatched vulnerabilities in tools like Metabase to extract large volumes of personal data from Japanese organizations. The root failure is twofold: APIs exposed without adequate authentication or rate-limiting controls, and software left unpatched despite publicly disclosed critical vulnerabilities. This matters because the affected sectors — retail, membership services, and business systems — hold sensitive consumer data at scale, making each breach a significant regulatory and reputational event. Unlike ransomware, these silent exfiltration attacks may go undetected for extended periods, amplifying the total volume of data exposed. Organizations must treat API surfaces and third-party analytics tools as first-class attack vectors requiring the same rigor as core infrastructure.",[155,156,157,158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","CIS Control 16: Application Software Security","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 AU-12: Audit Record Generation","NIST CSF ID.AM-2: Software platforms and applications inventoried","OWASP API Security Top 10: API2 Broken Authentication, API4 Unrestricted Resource Consumption","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of Personal Data Breach","ITIL Service Management: Change and Patch Management Practice","ISO\u002FIEC 27001:2022 A.8.8: Management of Technical Vulnerabilities",{"NIST SP 800-53 SI-2: Flaw Remediation":171,"GDPR Article 32: Security of Processing":172,"NIST SP 800-53 AC-3: Access Enforcement":173,"CIS Control 16: Application Software Security":174,"NIST SP 800-53 AU-12: Audit Record Generation":175,"CIS Control 13: Network Monitoring and Defense":176,"CIS Control 12: Network Infrastructure Management":177,"CIS Control 7: Continuous Vulnerability Management":178,"GDPR Article 33: Notification of Personal Data Breach":179,"GDPR Article 25: Data Protection by Design and by Default":180,"ITIL Service Management: Change and Patch Management Practice":181,"ISO\u002FIEC 27001:2022 A.8.8: Management of Technical Vulnerabilities":182,"NIST CSF ID.AM-2: Software platforms and applications inventoried":183,"OWASP API Security Top 10: API2 Broken Authentication, API4 Unrestricted Resource Consumption":184},"Requires timely remediation of known flaws in Metabase.","Requires appropriate security for personal data exposed through APIs.","Access enforcement ensures APIs only return data the caller is authorised to see.","Application security covers secure API design, including authentication and rate limits.","Audit records of API calls help detect mass data extraction.","Network monitoring can detect large data extraction via APIs.","Network controls limit exposure of internal tools like Metabase to the internet.","Continuous vulnerability management ensures tools like Metabase are patched promptly.","Data leaks via APIs may need to be reported within 72 hours.","Privacy by design limits what personal data APIs expose.","Patch management practices ensure tools like Metabase are kept current.","Requires timely action on technical vulnerabilities, such as those in Metabase.","An inventory of applications and APIs shows what is exposed.","Covers weak API authentication and missing rate limits, which enabled bulk data extraction."]