{"schema_version":"0.10.0","id":"LR-2026-0284","record_version":2,"title":"AI-assisted cyberattacks and data breaches against Japanese organizations (METI, GMO Internet, NPA, Sony Network Communications, IDC…","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.4,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.48,"unhedged_language":4.48},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-31","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: GBHackers Security · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-10-31","history":[{"date":"2026-10-31","from_level":null,"to_level":"preliminary","reason":"1 report: GBHackers Security · subject to change"}]},"sources_hash":"2595bc57ff0c67932b705aa510e20ca842839de7da0bd411eb40e7b2e583bf5f"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-30","incident_class":"security_compromise","failure_class":null,"agent_involved":false,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Japan reported a wave of AI-assisted intrusions across companies and government bodies.","tags":["ai-assisted-cyberattacks","japan","data-breach","ransomware","extortion","critical-infrastructure"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":2585481,"third_parties_affected_count":495,"severity":"major","severity_because":"major: Many third parties were affected across dozens of incidents, including millions of exposed customer records and 495 disrupted client organizations.","harm_class":["privacy","operational","financial"],"affected_description":"Sony Network Communications customers (2,585,481 records); 495 client organizations of IDC Frontier; about 125,000 police officers and staff across 20 prefectural forces; GMO Internet Group currency trading platform customers; METI's Electricity and Gas Transaction Surveillance Commission website","protected_class_involved":null,"data_categories_exposed":["pii","customer_data"],"loss_range_usd":null,"reversibility":"irreversible","downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://gbhackers.com/japan-ai-cyberattacks/","publisher":"GBHackers News","date":"2026-10-30","type":"press","title":"Japan Faces Growing Cyberattack Crisis as AI Tools Help Hackers Target Businesses and Government","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.tags":"C","event.responsible_party":"D","event.adversarial_actor":"C","event.agent_involved":"D","event.incident_class":"D","event.summary":"D","event.date_disclosed":"A","event.trigger":"D","event.detection_method":"D","impact.records_exposed":"C","impact.third_parties_affected_count":"C","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.reversibility":"D","impact.severity":"D","context.industry":"D","context.denominator_available":"D","context.country":"C","impact.severity_because":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Days earlier, hackers claimed to have published sensitive customer data from GMO Internet Group’s currency trading platform."}],"event.adversarial_actor":[{"source_index":0,"quote":"Days earlier, hackers claimed to have published sensitive customer data from GMO Internet Group’s currency trading platform."}],"event.responsible_party":[{"source_index":0,"quote":"Days earlier, hackers claimed to have published sensitive customer data from GMO Internet Group’s currency trading platform."}],"event.agent_involved":[{"source_index":0,"quote":"Experts say AI agents and open-source hacking tools make it easier for criminal groups to exploit outdated infrastructure and get past the Japanese language barrier."}],"event.tags":[{"source_index":0,"quote":"Attackers use AI to analyze networks, find vulnerable targets and evade detection."},{"source_index":0,"quote":"Japan is dealing with an intense wave of AI-assisted intrusions that has exposed weaknesses in its corporate and public-sector defenses."},{"source_index":0,"quote":"Dozens of incidents, from brokerages to delivery firms, have made data leaks routine."},{"source_index":0,"quote":"In addition, Sony Network Communications disclosed 2,585,481 exposed customer records, while ransomware hit SoftBank-owned IDC Frontier on October 8 and disrupted 495 client organizations."},{"source_index":0,"quote":"GMO also received an extortion demand of roughly ¥8 billion (about $50 million), as previously reported."},{"source_index":0,"quote":"According to reporting published by Bloomberg, on October 28, Japan’s Ministry of Economy, Trade and Industry (METI) disclosed unauthorized access to the website of the Electricity and Gas Transaction Surveillance Commission."}],"event.summary":[{"source_index":0,"quote":"Japan is dealing with an intense wave of AI-assisted intrusions that has exposed weaknesses in its corporate and public-sector defenses."}],"impact.records_exposed":[{"source_index":0,"quote":"In addition, Sony Network Communications disclosed 2,585,481 exposed customer records, while ransomware hit SoftBank-owned IDC Frontier on October 8 and disrupted 495 client organizations."}],"impact.third_parties_affected_count":[{"source_index":0,"quote":"In addition, Sony Network Communications disclosed 2,585,481 exposed customer records, while ransomware hit SoftBank-owned IDC Frontier on October 8 and disrupted 495 client organizations."}],"impact.harm_class":[{"source_index":0,"quote":"Days earlier, hackers claimed to have published sensitive customer data from GMO Internet Group’s currency trading platform."},{"source_index":0,"quote":"In addition, Sony Network Communications disclosed 2,585,481 exposed customer records, while ransomware hit SoftBank-owned IDC Frontier on October 8 and disrupted 495 client organizations."},{"source_index":0,"quote":"GMO also received an extortion demand of roughly ¥8 billion (about $50 million), as previously reported."}],"impact.affected_description":[{"source_index":0,"quote":"Other incidents include the National Police Agency reporting that data on about 125,000 officers and staff across 20 prefectural forces may be exposed through cloud provider Arcadia."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"Days earlier, hackers claimed to have published sensitive customer data from GMO Internet Group’s currency trading platform."}],"impact.reversibility":[{"source_index":0,"quote":"Days earlier, hackers claimed to have published sensitive customer data from GMO Internet Group’s currency trading platform."}],"context.industry":[{"source_index":0,"quote":"According to reporting published by Bloomberg, on October 28, Japan’s Ministry of Economy, Trade and Industry (METI) disclosed unauthorized access to the website of the Electricity and Gas Transaction Surveillance Commission."}],"context.country":[{"source_index":0,"quote":"Japan is dealing with an intense wave of AI-assisted intrusions that has exposed weaknesses in its corporate and public-sector defenses."}],"impact.severity":[{"source_index":0,"quote":"In addition, Sony Network Communications disclosed 2,585,481 exposed customer records, while ransomware hit SoftBank-owned IDC Frontier on October 8 and disrupted 495 client organizations."}],"impact.severity_because":[{"source_index":0,"quote":"In addition, Sony Network Communications disclosed 2,585,481 exposed customer records, while ransomware hit SoftBank-owned IDC Frontier on October 8 and disrupted 495 client organizations."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-30"}]},"notes_on_gaps":"No source states who first noticed any incident, so event.detection_method is omitted (unknown). No source names a cause for the AI-assisted attacks beyond attacker use of AI tools, so event.trigger and event.root_cause are omitted. No source states the date the intrusions occurred (only the IDC Frontier ransomware date of 2026-10-08 and the METI disclosure date), so event.date_occurred is omitted. No source states an autonomy arrangement, guardrails, tools granted to any AI system, or a model name/version/developer, so those system fields are omitted. event.agent_involved is set false because the AI is described as an attacker tool, not an autonomous agent causing the incident; failure_class is therefore null. The ¥8 billion extortion demand is a demand, not a stated loss, so direct_loss_usd is omitted. The 260 million figure is a national cumulative total, not this incident's scope. Severity major rests on the many third parties and live production compromises stated. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-31] system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.responsible_party: third_party. event.agent_involved: classified from described behaviour. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.summary: classified from described behaviour. event.trigger: no source states a cause. event.detection_method: no source says who first noticed. impact.reversibility: irreversible. context.industry: classified from described behaviour. context.denominator_available: no denominator is available for this incident."},"context":{"industry":"Public Administration","org_size_band":null,"country":"JP","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Attackers used AI agents and open-source hacking tools to scan networks, find vulnerable targets, write phishing campaigns and evade detection against Japanese companies and government bodies.","quote":"Attackers use AI to analyze networks, find vulnerable targets and evade detection. They also use it to automate vulnerability scanning and write phishing campaigns.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Hackers breached and published sensitive customer data, extorted a company, and ransomware disrupted client organizations, crossing data-protection and network boundaries.","quote":"Days earlier, hackers claimed to have published sensitive customer data from GMO Internet Group’s currency trading platform.","source_index":0,"grade":"C"},{"step":"reached","text":"Data on about 125,000 police officers and staff across 20 prefectural forces via cloud provider Arcadia, 2,585,481 Sony customer records, 495 IDC Frontier client organizations, and the METI commission website.","quote":"Other incidents include the National Police Agency reporting that data on about 125,000 officers and staff across 20 prefectural forces may be exposed through cloud provider Arcadia.","source_index":0,"grade":"C"},{"step":"done","text":"Japan activated its Active Cyber Defence framework on October 1, the Prime Minister promised an emergency cybersecurity package, and METI plans an AI-driven white-hat team in IPA from November; defenders were urged to patch PHP, enforce MFA and monitor for AI-driven scanning.","quote":"Japan activated its Active Cyber Defence framework on October 1.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-31","source_urls":["https://gbhackers.com/japan-ai-cyberattacks/"]}}