Since September 25, 18 Japanese companies have disclosed breaches, according to an October 22 post by semiconductor industry analyst SemiAnalysis. The companies named in the post include Tokyo Metro, Japan Post, Lawson, Nikkei, Yamato and Sagawa. The post also said attackers obtained data connected to about 6.6 million Times Car accounts.
That figure is confirmed in a detailed report from Times Mobility, the operator of the car-sharing service. In its second report on the unauthorized access to the Times Car web system, the company said third parties obtained information relating to approximately 6.6 million current, former and prospective Times Car and Times Business Service users.
The exposed information included names, addresses, contact details, driver’s-license information, images of identity documents and other account data, Times Mobility said. It added that credit-card information was not leaked. The cause of the incident remained under forensic investigation, according to the company.
The distinction matters. The number of affected accounts is clear, but the available material does not establish that every company in the reported cluster was attacked in the same way. It also does not show that artificial intelligence was used in each breach. The SemiAnalysis post presents the incidents as evidence of a broader shift in hacking economics, not as proof of one coordinated campaign.
A second large exposure
Lawson has separately confirmed a major incident involving its customer accounts. In its notice about personal-information leakage following unauthorized access, the convenience-store operator said its Lawson ID system was accessed without authorization between September 12 and 14, 2026.
The company said information from 2,155,345 accounts was exposed. A separate incident affected 26 users of Lawson’s application reservation service. Lawson said it had found no malware infection and no secondary misuse of the information at the time of its notice.
Together, the Times Mobility and Lawson disclosures show how a breach can affect people who may never have considered themselves targets. A stolen account record can contain the ordinary details of daily life, such as where someone lives, how they can be contacted and which document proves their identity. When those records are held in large centralized systems, one intrusion can create consequences for millions of people at once.
The incidents also illustrate why third-party and customer-facing systems have become a central concern for companies. A business does not need to lose payment-card data for a breach to become serious. Identity documents, addresses and contact information can be used in impersonation attempts, targeted scams or later attacks against other services.
Where AI enters the picture
The SemiAnalysis post argues that AI is changing the operating model of hacking. Tools that can analyze public information, generate convincing messages, modify malicious code or sort through stolen data may reduce the time and expertise required to conduct an attack.
In the past, a large campaign might have required specialists for reconnaissance, social engineering, malware development and data processing. AI could allow a smaller group to automate parts of that chain. It may not make every attacker more capable, but it can make repeated attempts cheaper and faster.
That is an important hypothesis, but it remains a hypothesis in relation to this specific breach wave. The available company disclosures do not attribute the Times Mobility or Lawson incidents to AI. Nor do they show that the 18 reported breaches shared one technique or one operator.
Japan’s National Institute of Information and Communications Technology has described one possible technical route. In its warning about server attacks through app analysis, NICT said its LETTICE threat-intelligence team identified an “App-to-Backend Attack.” In this type of incident, attackers study publicly available Android applications and use what they learn to target the backend servers supporting those apps.
NICT said AI could make application analysis and vulnerability discovery more efficient. The institute presented that as a possible contributing factor, however, not as evidence that AI caused the recent incidents.
That caution is essential. The existence of a technology that could accelerate attacks does not prove it was used in a particular case. Investigators still need to determine how access was obtained, what defenses failed and whether stolen information was subsequently misused.
A test for corporate defenses
Japan’s Financial Services Agency has responded to the wider pattern of concern. In its notice on strengthening cybersecurity and responses to transaction applications, the agency warned financial institutions that unauthorized access to public-facing customer services and business systems had led to leaks, including images of driver’s licenses.
The agency urged institutions to review cybersecurity and third-party risks. It also encouraged the use of chip-based identity-document reading ahead of an April 1, 2027 deadline. The recommendation reflects a broader principle: reducing the amount of sensitive information that systems can expose may be as important as detecting an intrusion after it begins.
The practical challenge is that modern services are connected by design. Mobile applications rely on backend systems. Businesses share data with contractors and technology providers. Customers reuse contact details and credentials across services. These connections make companies more useful, but they also create more paths into valuable information.
No opposing statement from the companies named in the SemiAnalysis post, or from a party disputing its broader interpretation, was found in the sources available for this article. The confirmed company notices establish the scale and sensitivity of at least two incidents. They do not yet establish a single campaign, a common attacker or universal AI involvement.
For customers, the immediate lesson is familiar but newly urgent: large account databases remain attractive targets, even when they do not contain payment information. For companies, the question is more difficult. It is no longer enough to ask whether an intrusion can be stopped. They must also ask whether their systems can recognize faster, more adaptive attacks, limit the information exposed by a single failure and disclose what happened before uncertainty becomes another source of harm.
Daniel Reyes is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna and qwen3-max. Out on the live web: gpt-5.6-luna and gpt-5.6-terra. Pictures: gpt-image-1 and gpt-image-1-mini. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Daniel Reyes's usual length and in Daniel Reyes's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.