Japan’s JPCERT/CC says personal-data leaks at Japanese organizations occurred in succession around September 2026, with reports involving several kinds of web-system weaknesses. Its October 8 alert describes mobile app API abuse, scanning for different known flaws and exposed files, and attacks involving Metabase—but it does not establish one coordinated campaign or say that any one method was used in every incident.
What the alert establishes—and what it does not
JPCERT/CC’s October 8, 2026 alert describes a potentially increasing pattern of data leaks involving web systems, distinct from routine ransomware and other unauthorized-access cases. The center says the information available is “limited and fragmentary” (translated wording) and cautions that the reported techniques do not mean every incident used the same method. The alert names neither a common attacker nor which technique affected any particular victim. Read JPCERT/CC’s alert.
As an Amazon Associate I earn from qualifying purchases.
The figures and examples reported alongside the alert provide context, not proof that the named organizations were breached through mobile APIs or Metabase. For example, the disclosures involving Times Car and Yakiniku King were reported while investigations into causes were still under way.
Recommended Free Tools
How the reported web attacks work
Mobile app APIs and management endpoints
A public smartphone app can reveal clues about the services behind it. JPCERT/CC says it received reports of attackers analyzing published apps to find API endpoints or keys, then probing APIs that might not be reachable through ordinary app screens. Reported actions include trying to change user privileges, create unauthorized accounts, and compare server responses to altered headers or malformed authentication tokens. The alert also describes blind NoSQL injection used to identify account information, stolen API keys reused after another system was compromised, and cases in which unauthorized management-API requests rewrote information. These are reported tactics, not a checklist that applies to every leak.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Known flaws and exposed files
The alert does not attribute the incidents to one shared software vulnerability. It says attackers may scan each target for different known flaws and take advantage of poor system management, such as exposed environment-configuration or backup files. Business-intelligence tools and employee-facing management systems can also be exposed to the internet even when operators did not intend them to be publicly accessible.
Metabase CVE-2026-72898
JPCERT/CC’s advisory, last updated August 14, 2026, describes CVE-2026-72898 as a serious unauthenticated SQL injection vulnerability. A remote attacker could send a crafted request to run unauthorized SQL against Metabase’s application database and potentially gain administrator privileges. The affected ranges and minimum fixed releases reported in that advisory are:
| Metabase release line | Advisory’s affected range | Minimum fixed release stated |
|---|---|---|
| 63 | Before x.63.5 | x.63.5 |
| 62 | Before x.62.9 | x.62.9 |
| 61 | Before x.61.11 | x.61.11 |
| 60 | Before x.60.17 | x.60.17 |
| 59 | Before x.59.21 | x.59.21 |
| 58 | Before x.58.24 | x.58.24 |
The advisory says versions before 58 are not affected by this particular issue and that Metabase Cloud had already applied mitigation at the time. These are the advisory’s August 2026 thresholds, not a substitute for checking the current release guidance: install a current fixed release and review Metabase’s security update as well as the JPCERT/CC advisory.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
How many incidents have been reported?
Macnica Security Research Center counted 119 similar publicly disclosed web-system leak incidents through October 6, 2026, compared with 84 in 2025 and 62 in 2024. Its 2026 tally included 81 cases disclosed from July onward; 65 of those 81 reportedly did not have enough public detail to determine the entry method. Macnica’s count excludes ransomware and cases it attributes to other attack groups. It is not a Japanese government total, a complete census of breaches, or evidence that the counted cases share a cause. These figures were reported by The Hacker News.
The same report cited several large disclosures: Park24 said on September 28, 2026, that data involving about 6.6 million Times Car accounts had been obtained from its service’s web system, and on September 29 said about 1.6 million accounts involved identity documents. On October 5, INTERNET Watch reported that Monogatari Corporation disclosed 10,788,963 Yakiniku King membership records. The October 8 report said the companies were investigating the causes; the disclosures do not establish that any of these cases involved the techniques in JPCERT/CC’s alert.
Other totals use different populations and should not be added to Macnica’s tally. Akamai’s 2026 APAC API Security Impact Study reported that 84% of Japanese survey respondents had experienced an API security incident in the previous 12 months; among respondents whose organizations faced API incidents, the average estimated cost was US$1,594,385, while 11% said they had a full API inventory and knew which APIs returned sensitive data. These are vendor-survey findings, not counts of the leak series. Separately, Cyber Security Cloud’s 2026 report on 2025 incidents counted 165 publicly announced corporate security incidents in Japan during calendar 2025 and 21,909,319 personal-information records. Its scope and classification differ from Macnica’s web-system series. Akamai study; Cyber Security Cloud report.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
What companies should do to reduce API and web-system risk
JPCERT/CC’s recommendations focus on controls that apply across public and internal APIs, rather than assuming every incident has the same entry point:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Limit abusive traffic. Set API request-rate limits, with separate quotas for login, password reset, SMS sending, and costly or abuse-prone searches.
- Authorize every endpoint. Check permissions on each request, including APIs hidden from normal app screens; restrict permitted users and HTTP methods.
- Reduce the impact of leaked credentials. Give API users and tokens only the permissions they need, set token expiry, and promptly revoke credentials that are no longer needed or may have been exposed.
- Patch and reduce exposure. Apply fixed software updates, remove unnecessary public-facing services and administrative features, and consider geographic access restrictions when a service is intended only for specific regions.
- Plan for what happens after a web-server compromise. Review possible lateral movement, improve detection and initial response, and prepare customer guidance that can reduce secondary harm, such as enabling MFA.
- Keep less data for less time. Remove information after legal or contractual retention ends or when it no longer serves its original purpose.
JPCERT/CC points administrators to OWASP’s API Security Top 10 and REST Security Cheat Sheet for additional API-security guidance.
How to check a Metabase server for compromise
JPCERT/CC relays a temporary Metabase workaround for cases where immediate updating is not possible: block access to /api/session/reset_password. This is not a replacement for installing a fixed release. If that endpoint was accessible from the internet, investigate for compromise even if the server has since been updated.
- Review access logs for the reported sequence. Look for
POST /api/session/reset_passwordreturning HTTP 400 followed byGET /api/user/currentreturning HTTP 200. JPCERT/CC identifies this as suspicious; investigate it in context rather than treating a match alone as proof. - Inspect accounts and credentials. Review active user sessions, API keys, and administrator accounts for activity or changes you cannot explain.
- Review application and database records. Examine Metabase and connected database logs for suspicious requests or activity, and change connected database credentials when compromise is suspected.
- Patch and restrict access. Install a current fixed Metabase release, confirm the password-reset endpoint is not unnecessarily exposed, and follow the current official security guidance.
The advisory’s affected-version thresholds and workaround are time-sensitive. Use the JPCERT/CC Metabase advisory and Metabase security update when checking a live deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
