Japan data leak concerns grow as 1.67 million JR East email addresses may be exposed
Japan is stepping up its cybersecurity response after a series of data breaches exposed millions of customer records across businesses and public institutions. The Financial Services Agency (FSA) of the country, on 9 October, called on banks to accelerate the process of using chip-based identity documents, such as passports or MyNumber cards, in opening new bank accounts. The shift comes after cyberattacks on transport firms, retailers, financial services and government-related companies have raised fears about the security of personal data storage and handling.
According to the Financial Times, regulators want lenders to move away from using driving licences as the primary method of identity verification. The new recommendation follows a series of reports in recent weeks of over 20 major companies reporting cyber incidents. There is also a risk that increasingly sophisticated attacks targeting businesses, public services and citizens’ personal data could become possible, officials have warned, as artificial intelligence (AI) could potentially enable hackers to find vulnerable systems and broaden the scope of their attacks.
Japan pushes banks towards chip-enabled identity verification
The FSA’s recommendation comes amid concerns that conventional ID documents could be compromised in data breaches if digitised. Pictures of the driving licences of car-sharing operator Times Car may have been breached in a recent incident, FT reported. The cybersecurity experts estimate that such images may be sold on dark web marketplaces for as little as ¥25 (around $0.15) apiece, though none have been sold yet, according to the report.
The Japanese government is viewing the increasing occurrences as a more serious threat to the nation’s security. The ruling Liberal Democratic Party held an emergency meeting of the National Cybersecurity Strategy Headquarters on Friday, 9 October. Its head, Masaaki Taira, described the situation as “a state of emergency in cyberspace”, while cybersecurity minister Toshiharu Furukawa warned of an exceptionally serious challenge.
JR East, Lawson and other companies report data exposure
The problem is not small, with several recent incidents to illustrate. East Japan Railway (JR East) said it believes that approximately 1.67 million customer email addresses may have been stolen via its booking system.
A ransomware attack revealed by SoftBank’s cloud services business, IDC Frontier, is also rumoured to be linked to the data exposure involving local government officials and other businesses. Other businesses impacted include the convenience store giant Lawson, hospitals, government buildings, retailers and transport-related businesses.
The ageing of Japan’s population and the continued use of legacy business systems have been suggested as potential contributing factors to Japan’s cybersecurity issues. Other experts have expressed concern over poor security practices and insufficient technology enhancements.
AI could make cyberattacks easier to scale
AI is adding to concerns because it can automate parts of the process for identifying vulnerable systems and preparing attacks. Masaki Hiraoka, MD, North-East Asia, cybersecurity company Blackpanda, said the tech might make smaller businesses more vulnerable, as it could shorten the time and effort required to do a security scan of them.
South Korea’s President Lee Jae Myung also noted evidence of AI use during cyberattacks on banks and is investigating suspected AI-assisted cyberattacks. However, the recent hacks in Japan have not been proven to be caused by AI.
The Japanese government has appealed for enhanced security measures after the incidents have continued to occur within various industries. Experts believe organizations need to update vulnerable systems, further improve access controls, and data protection to minimize opportunities for further breaches, even if the risk of verification is reduced with the introduction of a ‘chip’ to identity documents.
(With inputs from agencies)
