← Artículos y guías sobre fraude, ciberseguridad, privacidad y PLD
Japan cyberattacks: GMO, JAL and Sony, what is behind the wave
Japan faces a cyber emergency: GMO refused an ¥8bn ransom and JAL exposed 92,000 customers. The numbers, the AI angle and lessons for everyone.
Japan is living through its worst run of cyberattacks in recent memory. In October 2026, GMO Internet refused a ransom demand of about ¥8 billion ($50 million), Japan Airlines said reservation data for about 92,000 customers was accessed through supplier Amadeus, and Sony Network Communications disclosed a breach affecting more than 2.5 million people. Prime Minister Sanae Takaichi convened her cabinet on October 26 and pledged emergency measures.
What happened at GMO?
GMO detected an intrusion in its Onamae Desktop Cloud VPS service on October 20; malware may have reached up to 26,739 customer servers. After confirming data theft, it asked customers on October 27 to back up, disconnect and power down their PCs, and later confirmed data had been published. GMO refused to pay, offered ¥5,000 per customer and a ¥150 million (about $1 million) bounty for information on the attackers, receiving 321 tips in two days. MT4/MT5 trading credentials may have been exposed.
Why is Japan being hit so hard?
Recorded Future counted a 48% rise in reported attacks on Japanese entities from Q2 to Q3 2026 (621 to 918); Trend Micro said January–September attacks already exceeded all of 2025. Analysts cite legacy systems, weak APIs, stolen cloud credentials and known flaws. There are reports of AI-driven tooling, including the Chinese open-source ARTEX pentest tool, allegedly used against about 80 Japanese companies, though other researchers could not confirm AI use. A new Active Cyber Defense law, in force since October 1, also requires more incident reporting.
| Company | Disclosed impact |
|---|---|
| JAL / JTA | ~92,000 reservations; ~2,000 with passport numbers |
| Sony Network Communications | 2.5+ million people |
| Sourcenext | 22.5 million records via API |
| IDCFrontier | Ransomware hit 495 companies and local governments |
What should affected customers do?
- Treat calls and emails mentioning your booking or account as suspicious; use official channels only.
- Reset passwords, end sessions and turn on phishing-resistant MFA.
- Businesses: patch internet-facing systems, limit bulk API access and test backup restores.
Read about supply-chain attacks and follow the Radar.
Why does it matter outside Japan?
JAL and ANA were both affected through a global reservation provider, Amadeus, the same kind of supply-chain exposure that hits companies in Brazil, the US and everywhere else. US Defense Secretary Pete Hegseth and Japanese Defense Minister Shinjiro Koizumi discussed the attacks and agreed to strengthen cooperation. And leaked records become raw material for fraud: JAL said it would contact affected customers individually and warned them about phishing and fraudulent calls.
Analysts also point to concrete techniques. Japan's JPCERT/CC warned in October about exploitation of known vulnerabilities and misconfigurations, attacks on APIs (sometimes using stolen keys), a critical SQL injection flaw in Metabase rated CVSS 10, and web shells. Recorded Future's recommendations include migrating off legacy systems, hardening VPNs and routers, limiting bulk data retrieval through APIs, requiring phishing-resistant MFA, training staff on Japanese-language phishing, storing less personal data and testing backup restoration.
On ransom payments, see to pay or not to pay.
Fuente
- BleepingComputer — GMO urges customers to shut down PCs
- Tokyo Weekender — GMO million-dollar hacker bounty
- The Record — Japan Airlines warns of breach as country grapples with incidents
- Recorded Future — Behind Japan's warnings of a cyber crisis