AI-Driven Cyberattacks Surge in Japan, Exposing Security Flaws

Japan is grappling with a dramatic uptick in cyberattacks, with experts warning that the growing sophistication of artificial intelligence is enabling criminals to more effectively steal and exploit personal information. This alarming trend underscores significant weaknesses in the country's cybersecurity defenses.

An international hacking group known as Qilin has labeled Japan as "one of the countries with the weakest computer security in the world," a statement that echoes rising concerns over the frequency and severity of attacks targeting Japanese businesses and organizations. Research led by Yutaka Sejiyama, assistant director at the Macnica Security Research Center, indicates that the number of publicly disclosed incidents involving information leaks caused by cyberattacks has been on the rise since July.

As of October 9, Japan had already recorded 25 such incidents in that month alone. If this pace continues, the total could surpass 70, revealing an accelerating threat to corporate networks and personal data. Sejiyama attributes a significant part of this increase to the use of AI by cybercriminals. "Judging from the circumstances, there is no doubt that AI is being extensively used," he stated.

However, the AI technology exploited by these criminals may differ from common consumer AI services like ChatGPT and Gemini. Sejiyama suggests that attackers are likely utilizing what are known as "open-weight" AI models, which allow for extensive customization of their operations. These models provide access to the underlying parameters that dictate how an AI system functions, enabling modifications that can be used for a variety of malicious purposes. In contrast, commercial AI services typically impose stricter controls to prevent misuse.

The threat posed by these cyberattacks extends beyond mere data theft. Experts warn that AI is also increasing the value of stolen personal data, making it easier for criminals to combine disparate pieces of information and identify new opportunities for fraud. Recent leaks involving images of driver's licenses exemplify these risks. Criminals armed with such information can impersonate victims, apply for loans without their knowledge, or make unauthorized purchases.

Exploitation of Personal Data on Dark Web

Stolen personal information is frequently traded on the dark web, where it can be leveraged for various illicit activities. Even seemingly innocuous information can become valuable when combined with other leaked records. For instance, a criminal who acquires a person's name and email address may initially find limited opportunities for exploitation. However, if they can connect that information with a database containing the same person's name and credit card number, the potential for fraud increases significantly.

AI proves particularly adept at identifying connections among vast amounts of fragmented data, allowing attackers to create comprehensive personal profiles. This capability enables them to analyze victims' behaviors, determining the optimal times for fraudulent communications to appear legitimate. For example, in September, individuals who had made genuine accommodation reservations received fraudulent emails containing their actual booking information. These messages instructed recipients to reenter their credit card details or make urgent payments, capitalizing on the trust associated with familiar transactions.

As cyberattacks become more frequent and personal information leaks harder to prevent, experts emphasize the necessity for individuals to bolster their online account security. Sejiyama advises against reusing passwords across different services and encourages the use of multifactor authentication wherever possible. "Naturally, people should not reuse passwords, but it is also effective to actively use multifactor authentication, such as biometric verification or authentication apps, on websites that support it," he noted.

The Cover Story

Multifactor authentication adds an extra layer of security by requiring users to provide additional verification beyond just a password. This approach can significantly reduce the risk of unauthorized access, even if login credentials are compromised in a data breach.

The rapid rise of AI-assisted cybercrime presents a formidable challenge for Japan's digital economy, where the security of personal information relies not only on corporate defenses but also on the proactive measures taken by individual users. As attackers continue to adopt increasingly sophisticated technologies, experts stress that traditional password protections are no longer sufficient. Stronger authentication methods and heightened awareness of information security are essential defenses against the growing threat of online fraud.