INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Japan Sees Sharp Rise in Web Data Leaks Amid Attacks

| 2026-10-08 15:45 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
In the past few months, Japan has seen a sharp rise in web data leaks amid mobile API abuse and Metabase attacks. The JPCERT Coordination Center reported that attackers have exploited known software flaws to target Japanese organizations' systems, including business intelligence tools and employee-facing management systems. Data stored in these systems leaked in some cases, with an estimated 6.6 million accounts compromised by a third party on September 28, followed by the leak of identity documents from about 1.6 million accounts just one day later. The attacks are separate from ransomware incidents and may be increasing, leaving defenders with limited information to defend against them, including eight source IP addresses, five User-Agent strings, and a list of API controls.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-72898 and treat internet-facing systems that were not patched in time as potentially compromised until verified. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 8 IoCs Create Free Account
69.10.•••.•••
210.149.•••.•••
221.216.•••.•••
54.95.•••.•••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-72898CVE-2026-72898
Target & Sectors
PL JP KR FR
Incident Timeline
‎August 6
Metabase's August 6 security update fixed CVE-2026-72898, a zero-day flaw exploited against the company's own cloud service.
vulnerability CVE-2026-72898
Metabase's August 6 security update fixed CVE-2026-72898.
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
infrastructure 0.63.5
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
infrastructure 0.63.13
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
infrastructure 0.62.9
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
infrastructure 0.62.16
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
infrastructure 0.61.11
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
infrastructure 0.61.18
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
infrastructure 0.60.17
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
infrastructure 0.60.24
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
infrastructure 0.59.21
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
infrastructure 0.59.28
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
infrastructure 0.58.24
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
infrastructure 0.58.31
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
general_metric 63 0.63.13
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
general_metric 61 0.61.11
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
general_metric 60 0.60.17
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
general_metric 59 0.59.21 0.59.28
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
organisation Metabase
The flaw was exploited as a zero-day against Metabase's own cloud service, the company said on August 6.
‎August 11
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a vulnerability to its Known Exploited Vulnerabilities catalog on August 11, advising users to upgrade their systems.
organisation Known Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on August 11.
tactic T1588.006 - Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on August 11.
‎August 14
Threat actors exploited a vulnerability in Metabase, prompting the software to issue an urgent upgrade notice on August 14.
‎September 2026
Threat actors exploited the SQL injection flaw in Metabase, CVE-2026-72898, to target companies and leak large amounts of personal data.
observable 172.86.91.7
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
observable 210.149.87.120
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
observable 213.163.202.171
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
observable 221.216.140.129
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
observable 221.216.140.49
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
observable 3.112.252.14
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
observable 54.95.112.6
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
observable 69.10.51.162
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
organisation Macintosh
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
organisation Intel Mac OS
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
organisation KHTML
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
data_breach 2026 early September
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
data_breach 30 September
Macnica also found 99 similar cases in 13 other countries and regions, mostly from July to September, including 30 in South Korea, 11 in France and 8 in Poland.
organisation SQL
The Metabase Flaw and Which Versions to Run The third pattern is exploitation of CVE-2026-72898 , an SQL injection flaw in Metabase, an open-source BI tool that companies connect to their databases.
organisation CVSS
It carries a CVSS score of 10.0.
organisation JPCERT/CC's
How the Attackers Get In JPCERT/CC's alert describes three patterns.
organisation Operators
Operators who cannot upgrade yet can block the /api/session/reset_password endpoint as a temporary measure.
organisation POST
A server is likely compromised if its logs show a POST /api/session/reset_password request that returned 400, followed by a GET /api/user/current request that returned 200, Metabase said.
organisation Rotate
Rotate the credentials for every connected database.
organisation Review Metabase
Review Metabase activity and query history for unexpected activity.
organisation Indicators and Checks
Indicators and Checks JPCERT/CC published the source addresses and User-Agent examples below.
organisation Limit
Limit the number of requests per unit of time to stop repeated and bulk calls.
organisation Enforce
Enforce access control on every API endpoint, including non-public ones, and accept only permitted users and HTTP methods.
‎September 28
A third party obtained data on approximately 6.6 million accounts from Park24's Times Car car-sharing service web system on September 28.
general_metric 6.6 accounts
Park24 said on September 28 that a third party obtained data on about 6.6 million accounts from the web system of its Times Car car-sharing service.
‎October 5
Threat actors exploited vulnerabilities in Monogatari Corporation's mobile app to leak 10,788,963 records from its member system.
organisation Monogatari Corporation
Monogatari Corporation, which runs the Yakiniku King restaurant chain, said 10,788,963 records leaked from the member system of its Yakiniku King app, INTERNET Watch reported on October 5.
data_breach 10,788,963 records
Monogatari Corporation, which runs the Yakiniku King restaurant chain, said 10,788,963 records leaked from the member system of its Yakiniku King app, INTERNET Watch reported on October 5.
‎October 6
Between October 6 and this year, Japan experienced a sharp rise in web data leaks resulting from mobile API abuse and Metabase attacks.
target_region Japan
Macnica counted 119 incidents made public this year through October 6 in which personal data was stolen or leaked through web systems run by organizations in Japan.
general_metric 119 incidents
Macnica counted 119 incidents made public this year through October 6 in which personal data was stolen or leaked through web systems run by organizations in Japan.
‎October 7
The Personal Information Protection Commission of Japan issued its own alert on October 7, citing an analysis by the Security Research Center at Macnica.
target_region Japan
Privacy Regulator Issues Its Own Alert Japan's Personal Information Protection Commission issued its own alert on October 7 to businesses that handle personal data.
One comes from the Security Research Center of Japanese company Macnica, in an analysis published October 7 that the alert cites.
organisation Personal Information Protection Commission
Privacy Regulator Issues Its Own Alert Japan's Personal Information Protection Commission issued its own alert on October 7 to businesses that handle personal data.
organisation the Security Research Center
One comes from the Security Research Center of Japanese company Macnica, in an analysis published October 7 that the alert cites.
‎October 8, 2026
Threat actors exploited a known flaw in Metabase, a Business Intelligence tool, to target Japanese users.
organisation IP
For defenders, the alert includes eight source IP addresses, five User-Agent strings, and a list of API controls, including access controls on every endpoint, public or not.
organisation API
For defenders, the alert includes eight source IP addresses, five User-Agent strings, and a list of API controls, including access controls on every endpoint, public or not.
organisation BI
The only product it names as a target is Metabase , a BI tool with a known flaw that attackers have exploited.
‎August 12 to September 7
A third party exploited a flaw in AhaSlides' Metabase, gaining unauthorized access from August 12 to September 7.
organisation AhaSlides
AhaSlides said a third party exploited the flaw in its Metabase and had access from August 12 to September 7.
‎2026/10/08
Attackers behind a string of personal data leaks at Japanese organizations abused APIs for mobile apps and targeted known software flaws.
organisation Japan Sees Sharp Rise
Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks.
organisation the JPCERT Coordination Center
Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said.
organisation JPCERT/CC
Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said.
organisation OWASP
…in functions that ordinary users are not allowed, or suspicious command execution Access to admin functions from unusual IP addresses High database load or heavy session use at the same time as a rise in traffic More errors in database logs More login attempts For APIs, JPCERT/CC recommends six controls and points to OWASP guidance such as the OWASP API Security Top 10 for details:
Tactical Metrics
Metrics
data_breach
30
September
Macnica also found 99 similar cases in 13 other countries and regions, mostly from July to September, including 30 in South Korea, 11 in France and 8 in Poland.
Metrics
infrastructure
‎0.63.5
Software Version
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
Metrics
infrastructure
‎0.63.13
Software Version
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
Metrics
infrastructure
‎0.62.9
Software Version
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
Metrics
infrastructure
‎0.62.16
Software Version
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
Metrics
infrastructure
‎0.61.11
Software Version
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
Metrics
infrastructure
‎0.61.18
Software Version
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
Metrics
infrastructure
‎0.60.17
Software Version
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
Metrics
infrastructure
‎0.60.24
Software Version
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
Metrics
infrastructure
‎0.59.21
Software Version
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
Metrics
infrastructure
‎0.59.28
Software Version
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
Metrics
infrastructure
‎0.58.24
Software Version
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
Metrics
infrastructure
‎0.58.31
Software Version
Metabase numbers the enterprise builds of the August 6 fixes 1.x instead of 0.x. Version Release That Fixes CVE-2026-72898 Metabase's Minimum Safe Release 63 0.63.5 0.63.13 62 0.62.9 0.62.16 61…
Metrics
data_breach
2,026
Early September
API abuse, around September 2026 IP : 3.112.252[.]14 IP : 54.95.112[.]6 IP : 69.10.51[.]162 IP : 172.86.91[.]7 IP : 210.149.87[.]120 User-Agent : curl/7.88.1 User-Agent : python-requests/2.34.2 User-Agent : Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 Metabase exploitation, early August to early September…
Metrics
data_breach
10,788,963
Records
Monogatari Corporation, which runs the Yakiniku King restaurant chain, said 10,788,963 records leaked from the member system of its Yakiniku King app, INTERNET Watch reported on October 5.
Intelligence Sources
The Hacker News 2026-10-08