Macnica counts 119 publicly disclosed web-system data breaches; AI’s role remains unclear

Macnica counted 119 publicly disclosed personal-data breaches involving Japanese web systems through October 6, 2026, and said 81 were disclosed from July onward.[1] The count covers publicly disclosed personal-information theft or leakage through web systems operated by domestic organizations from January 2024 through that date; ransomware is excluded.[2] Macnica said 65 cases lacked enough explanation to classify, and confirmed at least 25 cases involving website defacement or misuse that did not specify a concrete concern about personal-data leakage.[2] These limits matter when interpreting the total: it is not a count of all cyber incidents or confirmed AI attacks.

Macnica said logs and traces did not prove AI use across the 81 cases it examined, and investigators had not confirmed AI-discovered zero-day vulnerabilities behind the broader breach wave.[1] Separately, JPCERT/CC said investigators confirmed attackers used AI to scan for known vulnerabilities and attack via APIs.[3] It also reported attack attempts abusing the AI-assisted penetration-testing platforms Cairn, CyberStrikeAI and ARTEX.[4] JPCERT/CC cautioned that the incidents it described were not necessarily carried out using the same method in every case.[4] Macnica said available information limits efforts to establish a shared method or measure AI’s exact role.[1]

Macnica said attackers appeared to target a wide range of publicly accessible web systems, particularly sites holding personal information, rather than one specific company.[2] It said targets had expanded beyond e-commerce to member services, business systems and customer-support systems.[2] JPCERT/CC also described affected systems including business-intelligence tools and employee-facing management systems not intended for general-public access.[4] Macnica reported six servers associated with AI-powered attacks and targets across finance, ecommerce and logistics.[1] It also found 99 similar cases across 13 other countries and regions, but said the available information did not establish whether Japan was the only target.[5]