TrendAI reported on October 12 that 86 cybersecurity incidents were publicly disclosed in Japan in September 2026. The count was about 18% higher than August and 37% higher than July, and it tracks public disclosures—not every attack that occurred. TrendAI’s report also says its total for the first nine months of 2026 had already surpassed its full-year 2025 count.
What PARK24 confirmed about the Times CAR breach
PARK24’s September 28 notice confirmed that unauthorized access to the Times CAR web system exposed personal information linked to about 6.6 million accounts. The figure covers current and former Times CAR and Times Business Service members, as well as applicants whose enrollment was not completed. Times Mobility, the PARK24 subsidiary that operates Times CAR, detected the access at 9:07 a.m. on September 25 and said it had blocked the access route by 7:25 a.m. on September 26. PARK24’s notice lists names, addresses, birth dates, phone numbers, email addresses, driver’s-license and identity-document information, passwords, and IDs for external partner services among the affected information.
PARK24 said passwords were stored in a non-reversible format. In its September 28 notice, the company also said it had found no evidence that the information had been made public or misused, and that no credit-card information was breached.
Separate reports track different measures
The Associated Press reported a separate annual case series from a Yomiuri/Trend Micro study: more than 500 cases in 2026 by October 9, compared with 473 in 2025 and 503 in 2024. TrendAI’s 86 figure, by contrast, counts publicly disclosed cybersecurity incidents in Japan during September.
NHK WORLD-JAPAN’s October 7 report cited cybersecurity firm Mgnika’s estimate of nearly 120 information-leak cases so far in 2026. Mgnika put the monthly average at about six during the first half of the year and 23 per month since July. NHK also reported separate company disclosures: more than 940,000 records at GMO Research and AI, up to 1.73 million membership accounts at Mr. Max Holdings, and about 100,000 people potentially affected at Citizen. A JOSES survey cited by NHK found that 96% of Nikkei 225 companies had experienced a data breach over the preceding three years.
What TrendAI and Japanese authorities recommended
In recent incident-response engagements in Japan, TrendAI said its teams encountered attackers exploiting known vulnerabilities in internet-facing applications and placing web shells on servers. A web shell is a tool that can give an attacker remote access to a compromised server. TrendAI described privilege escalation, movement to other systems, and database access as possible follow-on risks from those intrusions.
TrendAI said it had not established a connection between attackers’ use of AI and the recent incidents in Japan. It discussed AI-assisted reconnaissance and phishing as broader capabilities, while recommending that organizations prioritize internet-facing systems and known exploited vulnerabilities, harden web servers, monitor database access, and review suppliers’ incident-notification and recovery arrangements. These are security measures the company recommends, not a guarantee against breaches.
Japan’s National Cybersecurity Office sent guidance to ministries for distribution to local public bodies and private companies, including keeping protections updated, using strong passwords, and strengthening supply-chain security. Separately, the Financial Services Agency asked financial institutions to review cyberattack response procedures and identity checks. Reporting by Nippon.com, based on Jiji Press, said financial services minister Satsuki Katayama urged identity verification that includes reading data from identification-card chips.
