Japanese organizations, one after another, are faced with hacks and leaks of personal data. The JPCERT/CC National Response Center has warned of a wave of attacks in which attackers search for old vulnerabilities, study the API applications, and use stolen access keys.
The warning is published against the background of a series of incidents that have increased since around September 2026. Both public applications and systems for employees and business intelligence tools, which are usually not designed for visitors from the Internet, were hit. JPCERT/CC acknowledges that the technical information is still fragmented, and does not claim that all attacks are carried out in the same way.
The first scenario begins with the search for known vulnerabilities. Attackers scan different programs and look for weaknesses for each victim, not limited to one mistake. In parallel, attackers try to get to configuration files and backups opened due to incorrect settings. The stolen files are able to reveal information even without the use of new vulnerabilities.
The second scenario is related to the API through which applications exchange commands with servers. Attackers analyze public programs for smartphones to find addresses of service interfaces and keys. Then directly address the internal functions that are not available through a normal screen. In some cases, such requests have led to illegal changes in information.
The attackers also changed the rights of users and created foreign accounts. They compared the server’s responses to different HTTP headers and specially incorrect authorization tokens. Another technique is associated with a blind NoSQL injection, when a series of requests helps to gradually determine the information about accounts. API keys stolen earlier from other systems were also used for the entry.
JPCERT/CC listed five suspicious IP addresses associated with attacks through the API in September, including 3.112.252[.]14 and 54.95.112[.] 6. The journals received requests with the symbols curl/7.88.1 and python-requests/2.34.2. The Center warns that these addresses could go to good-faith users, so one coincidence is not enough for charges.
The third scenario concerns the Metabase analytics platform. Through the API, attackers operated the CVE-2026-72898 SQL injection, which can give administrator rights without authorization. JPCERT/CC warned about the problem on August 14. The new document names three IP addresses seen from early August to early September and the characteristic User-Agent Metabase-GHSA-vwf4/2.0.
In the предупрежденииwarning, JPCERT/CC advises limiting the frequency of API requests, especially when entering and resetting your password. All interfaces, including internal ones, should verify the user’s rights. Tokens are advised to set validity period and minimum permits. Organizations are also advised to update programs, close unnecessary panels from the Internet, check logs and delete unnecessary data.
The warning is published against the background of a series of incidents that have increased since around September 2026. Both public applications and systems for employees and business intelligence tools, which are usually not designed for visitors from the Internet, were hit. JPCERT/CC acknowledges that the technical information is still fragmented, and does not claim that all attacks are carried out in the same way.
The first scenario begins with the search for known vulnerabilities. Attackers scan different programs and look for weaknesses for each victim, not limited to one mistake. In parallel, attackers try to get to configuration files and backups opened due to incorrect settings. The stolen files are able to reveal information even without the use of new vulnerabilities.
The second scenario is related to the API through which applications exchange commands with servers. Attackers analyze public programs for smartphones to find addresses of service interfaces and keys. Then directly address the internal functions that are not available through a normal screen. In some cases, such requests have led to illegal changes in information.
The attackers also changed the rights of users and created foreign accounts. They compared the server’s responses to different HTTP headers and specially incorrect authorization tokens. Another technique is associated with a blind NoSQL injection, when a series of requests helps to gradually determine the information about accounts. API keys stolen earlier from other systems were also used for the entry.
JPCERT/CC listed five suspicious IP addresses associated with attacks through the API in September, including 3.112.252[.]14 and 54.95.112[.] 6. The journals received requests with the symbols curl/7.88.1 and python-requests/2.34.2. The Center warns that these addresses could go to good-faith users, so one coincidence is not enough for charges.
The third scenario concerns the Metabase analytics platform. Through the API, attackers operated the CVE-2026-72898 SQL injection, which can give administrator rights without authorization. JPCERT/CC warned about the problem on August 14. The new document names three IP addresses seen from early August to early September and the characteristic User-Agent Metabase-GHSA-vwf4/2.0.
In the предупрежденииwarning, JPCERT/CC advises limiting the frequency of API requests, especially when entering and resetting your password. All interfaces, including internal ones, should verify the user’s rights. Tokens are advised to set validity period and minimum permits. Organizations are also advised to update programs, close unnecessary panels from the Internet, check logs and delete unnecessary data.
