Large-scale unauthorized access and data leaks keep coming, with damage spreading across industries and company sizes. On November 2, GMO Internet Group representative Masatoshi Kumagai held a news conference and apologized after customer information was leaked in a breach. He also acknowledged that security specialists inside the group had flagged problems earlier and the company failed to act on them.
Whether generative AI was used in these incidents is not clear. But AI could be making conventional attacks more efficient and widening the threat to companies and organizations that were previously hard to target, according to Tomoki Sawada, an executive officer and partner at KPMG Consulting. Sawada has worked as a security consultant for more than 20 years, supporting security programs across global groups in cooperation with KPMG firms overseas.
A wave of leaks since September
Several large breaches were disclosed between September and October, with the month of first announcement in parentheses.
- Times Car (September): about 6.63 million records leaked, including names, addresses and driver's license information.
- Yamato Transport (September): about 5.26 million records leaked, including names, addresses and details of purchased products.
- Yakiniku King (October): about 10.79 million member records leaked from the official app.
- Lawson (October): about 2.16 million pieces of personal information leaked, including names and addresses.
- Bookoff (October): membership information for about 6.38 million people leaked.
The surge in attacks is not limited to Japan. KPMG's analysis of the Asia-Pacific region found the same trend across the area, Sawada said.
Attackers running AI around the clock
One factor behind the increase, Sawada said, is attackers' use of AI. "Attackers may be using AI to speed up and launch attacks continuously for 24 hours," he said.
In the past, probing a specific application such as WordPress or a known vulnerability and narrowing down a target took time and effort. AI now makes that work more efficient and widens the pool of targets, he said.
Attacks through APIs have been prominent. The method involves analyzing a smartphone app to find weaknesses in the server it connects to, and the National Institute of Information and Communications Technology (NICT) flagged it in October as the "A2B attack." Sawada expects AI to make app analysis of this kind more efficient too.
Size no longer shields a company
Attackers no longer choose targets by size. "They attack where they can attack," Sawada said. Small and midsize companies were long thought to be less of a target because they hold less important information than large corporations. That has changed, he said: "It has shifted to a form where AI runs for 24 hours and attacks weak points indiscriminately."
KPMG's latest survey, Cybersecurity Survey 2026/27, found more respondents reporting attacks using methods that generative AI could readily exploit than in the previous survey. For phishing, the share answering that an attack occurred but caused no operational damage rose from 49.2% to 66.3%. For fraudulent payment instructions using deepfakes, the same answer rose from 6.2% to 15.8%.
KPMG points out that generative AI has made the Japanese in attack emails more natural, making it harder to spot an attack from awkward wording.
Sawada sees the rise in attacks as more than a temporary trend and expects it to be hard to bring under control. Damage totals and the number of disclosed incidents may fall as companies improve their defenses, but a decline in attacks themselves will be "quite difficult," he said.