Japan is facing a growing wave of AI-powered cyberattacks, with dozens of companies hit by data breaches. A government energy website and forex platform are among the latest targets.
Japan is facing a growing cybersecurity crisis, with dozens of companies across sectors reporting cyberattacks, unauthorised access and data leaks as hackers increasingly turn to artificial intelligence (AI) to identify vulnerabilities and break into computer systems.
The latest incidents have reportedly targeted a government energy-related website and a currency trading platform, adding to concerns that AI tools are making cybercrime faster, cheaper and easier to execute.
The attacks have put Japan’s corporate and digital infrastructure under scrutiny, with businesses in finance, retail, transport, logistics and other sectors reporting security breaches in recent weeks. Investigations by
Japanese cybersecurity specialists have also pointed to the use of a Chinese-developed AI tool called Artex in attacks against several Japanese companies.
According to a report by Channel News Asia, citing findings by GMO Cybersecurity by Ierae, a subsidiary of Tokyo-based GMO Internet Group, Artex was used in a series of attacks that appeared to overwhelmingly target Japanese organisations.
The security firm said it had identified six internet servers launching AI-powered attacks. The servers appeared to be organised according to target industries, including finance, e-commerce and logistics. The company said it had shared its findings with law enforcement agencies to help prevent further attacks.
Government Energy Website Also Targeted
The latest government-related incident came on October 28, when Japan’s Ministry of Economy, Trade and Industry (METI) announced unauthorised access to the website of the Electricity and Gas Transaction Surveillance Commission. The commission oversees Japan’s electricity and gas markets.
The announcement adds to a series of security concerns involving government and energy-related digital infrastructure.
Separately, several Japanese electricity companies temporarily suspended parts of their websites and online services after the disclosure of critical vulnerabilities in PHP, a widely used programming language.
To prevent possible exploitation, companies including Tohoku Electric Power, Kyushu Electric Power and Shikoku Electric Power took precautionary measures.
Some services, including electricity forecasts and online customer procedures, were temporarily made unavailable. The companies did not initially report confirmed data leaks linked to the vulnerability.
GMO Internet Hit By Major Cyberattack
One of the most significant recent incidents involves GMO Internet Group, whose cloud service, Onamae.com Desktop Cloud, is used by customers for automated foreign exchange (forex) trading.
The company detected malicious software on some customer servers on October 20 and subsequently shut down the service. As many as 26,739 server environments may have been affected, raising concerns about the possible exposure of customer information and login credentials.
The breach also had financial implications. Some customers reported unauthorised transactions on their trading accounts, prompting GMO to promise compensation for losses linked to the incident. The company also announced a goodwill payment of 5,000 yen (around $32) to every customer, irrespective of whether they had suffered financial losses.
The attackers reportedly demanded $50 million in cryptocurrency and threatened to release stolen customer information if the company refused to pay. GMO rejected the demand and approached Japanese authorities.
Tokyo police have since begun investigating the incident.
The company has also offered customers an alternative service free for six months.
Dozens Of Companies Under Cyberattack
The GMO incident is part of a much wider wave of cyberattacks affecting Japanese businesses and public institutions.
According to cybersecurity reports, companies across sectors, including retail, transport, finance and technology, have reported unauthorised access and data breaches. Among the affected organisations are major Japanese businesses, online platforms and service providers.
The Japan National Police Agency also reported that personal information belonging to around 125,000 police officers and staff members across 20 prefectural police forces may have been compromised following an attack involving its cloud service provider, Arcadia.
Separately, Japanese media company Nikkei reported multiple data breaches, while car-sharing operator Park24 announced compensation for customers affected by a personal information leak.
Reuters reported on October 26 that Japan had recorded 723 cybersecurity incidents by October 20, already exceeding the full-year totals for both 2024 and 2025. The incidents have raised concerns about the potential economic fallout of increasingly frequent cyberattacks.
Chinese AI Tool Artex Under Scanner
A major concern emerging from the investigations is the suspected use of artificial intelligence to automate cyberattacks.
GMO Cybersecurity by Ierae has identified traces of a Chinese-developed AI tool called Artex in attacks targeting Japanese organisations. The tool was originally developed to help organisations test their cybersecurity systems and identify weaknesses before hackers could exploit them.
The growing threat is not limited to Japan. South Korean authorities have also linked Artex to cyberattacks targeting financial institutions, with at least seven financial companies reportedly affected and personal information belonging to around 68,000 people stolen.
Japan Considers Stronger Cybersecurity Measures
The scale of the attacks has prompted calls for stronger cybersecurity measures in Japan. The head of the ruling Liberal Democratic Party’s cybersecurity committee recently described the situation as a “state of emergency in cyber space”.
Prime Minister Sanae Takaichi’s government is also preparing emergency measures to strengthen the country’s defences against cyber threats. Japan’s active cyber defence framework, which came into operation on October 1, allows authorities to take pre-emptive action against malicious servers in certain circumstances.
The government is also looking at using AI-powered simulations to identify weaknesses in digital infrastructure and improve preparedness.
