Cyberattacks targeting companies through publicly accessible websites and apps have more than doubled from last year, according to Macnica, a major Japanese cybersecurity company.
There have been 216 cases involving confirmed or suspected data breaches reported so far this year, or 2.6 times the total for all of last year.
Finding vulnerabilities in individual websites has traditionally required considerable time and money, but advances in artificial intelligence are believed to have made it easier for attackers to identify weaknesses.
At a ministerial meeting on cybersecurity held?Monday, officials presented an analysis showing that attackers are increasingly scanning web-based systems to find entry points and steal personal information in a short period of time. A government official said AI was likely being used in these attacks.
According to Yokohama-based Macnica, publicly reported cases of data breaches rose sharply from this summer, with 101 cases in October alone so far.
Recent cases of cyberattacks through websites and apps include software company Sourcenext, which is suspected of experiencing a breach involving about 22.5 million customer records, and Skyticket, a travel booking website that also reported the leakage of large amounts of customer information.
These attacks exploit weaknesses directly in websites and apps, allowing hackers to access information without first breaking into a company’s internal network.
In some cases, attackers log in as legitimate users and attempt to view other customers’ information that they should not be able to access.
Targets are also becoming more diverse. While e-commerce sites previously accounted for a particularly large share of incidents, attacks now affect a wider range of services, including membership websites and booking platforms.
Data breaches or suspected leaks have been reported at everyday services such as library catalog search systems, sightseeing train seat reservations and university facility booking systems.
Vulnerabilities specific to individual websites cannot necessarily be fixed simply by updating commonly used software.
Yutaka Sejiyama of Macnica said attackers were exploiting blind spots in security measures and stressed that companies need to identify and fix weaknesses in their own systems.
Hiroshi Tokumaru, a director at EG Secure Solutions, a Tokyo-based cybersecurity firm, noted that security measures are often given lower priority for websites that do not handle confidential information or financial transactions.
As AI advances, attacks that were previously too time-consuming to be worthwhile are becoming easier to carry out, he said, adding that the balance of power between attackers and defenders has shifted.
With your current subscription plan you can comment on stories. However, before writing your first comment, please create a display name in the Profile section of your subscriber account page.