“Attack-Ready in 30 Minutes”: AI-Armed Hackers Exploit Gaps in Corporate Security

Weak identity verification and access controls open the door to data breaches
Personal data exposed at Japanese restaurant chains and retailers, South Korean banks
Evidence of AI-assisted malware development heightens concerns

A succession of large-scale personal data breaches at Japanese companies and South Korean financial institutions has raised alarm over security management. In Japan, attacks have affected industries ranging from restaurants and retail to healthcare, while major banks, savings banks and consumer finance companies in South Korea have also suffered customer data leaks. Evidence that artificial intelligence (AI) has been used to develop malware and identify vulnerabilities has compounded concerns about the speed and scale of attacks. Some affected companies were found to lack even basic safeguards, including identity verification and access controls, prompting criticism that inadequate inspections and management after systems were deployed had amplified the damage.

Japan Records 600 Cybersecurity Incidents This Year Alone

According to cybersecurity company Trend Micro on October 12, Japanese companies and local governments disclosed 600 incidents involving unauthorized access and other security breaches between the start of the year and the end of September, already exceeding last year's full-year total of 593. This month also brought confirmation that more than 10 million membership records had been stolen from a single company. Restaurant operator Monogatari Corporation disclosed on October 5 that a breach of the app for its Yakiniku King restaurant chain had exposed 10.78 million records. That represented nearly all of its 10.8 million registered records, with the compromised information including names and email addresses.

Japanese diversified chemical company Asahi Kasei is also investigating a potential personal data breach after a cyberattack on a subsidiary's information website for medical professionals. Its pharmaceutical subsidiary, Asahi Kasei Therapeutics, said on October 6 that unauthorized access had occurred in a membership database linked to Pharma DIGITAL, a website providing healthcare professionals with information on medicine and the use of pharmaceuticals. The potentially affected population comprises approximately 558,000 healthcare professionals and 700 employees. The information at risk was understood to include healthcare professionals' names, affiliated medical institutions, clinical departments and some email addresses. After the external contractor responsible for operating the website and managing its information reported suspicious activity on October 2, the company suspended the website and blocked the intrusion route. In its October 6 announcement, Asahi Kasei said it had not confirmed any harm resulting from misuse of the information and was working with outside specialists to investigate the scope and cause of the potential breach.

Cyberattacks Sweep Across Japanese Retail, Finance and Manufacturing

Large-scale breaches have continued to emerge. At car-sharing service Times Car, personal information was leaked from approximately 6.6 million accounts, including names, addresses, dates of birth, telephone numbers, driver's license information and images of identification documents. Those affected reportedly included not only current members but also former members and applicants who had not completed registration. MrMax Holdings, which operates the MrMax discount retail chain, also announced on October 6 that a server breach may have exposed the user IDs, names, email addresses and telephone numbers of up to 1.73 million people, including users of its official app and online store.

At GMO Research & AI, a research company affiliated with GMO Internet Group, names, dates of birth, email addresses and other information belonging to as many as roughly 940,000 people may have been leaked, while membership reward points worth approximately $18,100 were stolen. At watchmaker Citizen Watch, an attack on the server of an outside contractor handling customer inquiries put the personal information of approximately 100,000 people at risk. The potentially compromised data included names, addresses, telephone numbers and email addresses submitted through the websites of three brands—Citizen, Bulova and Frederique Constant. Bank account or credit card details may also have been exposed if customers included them in their inquiries. At Daiwa Securities, 220,000 records were leaked, of which 110,000 contained names, email addresses, account numbers and other information.

Table 1. Major Confirmed and Potential Personal Data Breaches at Japanese Companies

Seven South Korean Financial Institutions Also Breached

South Korea has also seen a succession of customer data breaches as hackers targeted major banks, savings banks and consumer finance companies. At Shinhan Bank, the names, contact details, annual incomes and calculated loan limits of approximately 25,000 customers were found to have been leaked late last month. The compromised data also included 66 resident registration numbers and 97 personal identification codes (CI). At KB Kookmin Bank, an attack on a mobile work-support system for employees exposed the names, telephone numbers, addresses and encrypted resident registration numbers of 119 customers. Hana Bank also suffered a breach affecting 89 customers, with the exposed information confirmed to include names, resident registration numbers, addresses, email addresses, telephone numbers and employers' names.

Regional banks, savings banks and consumer finance companies were also affected. At BNK Busan Bank, an external intrusion into a mobile sales-support system exposed the personal information of 11 outsourced development staff. Yegaram Savings Bank detected indications on September 30 that an unidentified hacker had accessed a server storing customer information, with names, dates of birth and contact details belonging to approximately 40,000 people estimated to have been leaked. At Hyundai Capital, an attack on a lookup page used by customers to verify mortgage solicitors' identities exposed some personal information belonging to 146 solicitors. The compromised information included names, mobile phone numbers, email addresses and Credit Finance Association registration numbers, as well as internal solicitor identification numbers and resident registration numbers. The discovery of a security incident at Welcome Savings Bank brought the number of affected financial institutions to seven.

Evidence Points to AI Use in Ransomware Deployment and Backup Disruption

Behind the succession of cyberattacks is AI that assists with everything from analyzing targets to developing malware. Cisco Talos, which investigated ransomware incidents in Japan, discovered Python programs on a server used by the Qilin hacking group that it considered likely to have been written with AI. The tools were designed to deploy ransomware across multiple computers, destroy data at specified times and disable backups needed for recovery. The programs contained comments explaining the sequence of operations, consistently formatted execution logs and detailed descriptions of their intended purposes and execution requirements. Based on these code characteristics and traces of large language model (LLM) activity left on the server, Talos assessed the likelihood of AI generation with “moderate to high” confidence.

Experimental findings have also shown that AI can sharply reduce the time needed to prepare an attack. Trend Micro tested the process of analyzing a target and building a phishing website using only publicly available information. An AI-enabled tool completed the work in less than 30 minutes—a task that had taken two researchers approximately a week. The test included collecting publicly available information from sources such as professional networking platform LinkedIn to profile targets and use those findings in tailored attacks. The experiment demonstrated that AI could handle the process from gathering information needed to gain a victim's trust to creating a fraudulent website designed to steal information.

AI Security Testing Tools Turned Against Financial Institutions

Investigators examining attacks on South Korea's financial sector obtained AI tool configuration files and conversation logs. U.S. cybersecurity company CrowdStrike analyzed servers linked to attacks spanning late last month and early this month and found traces of ARTEX, an AI-powered penetration testing tool developed in China, as well as Claude Code. The findings pointed to the misuse of tools designed to identify security vulnerabilities for actual intrusions. The attacker operated a Hong Kong-based server separately from the server running ARTEX and was found to have connected ARTEX to a DeepSeek model. Separate Claude Code sessions also contained evidence that other AI models, including GLM and Grok, had been used.

Conversations with AI also yielded clues to the attacker's identity. While asking Claude Code to prepare a security researcher résumé, the attacker entered information describing achievements using ARTEX, along with an age of 26, a residence in Maoming in China's Guangdong province and an educational background at South China University of Technology. CrowdStrike assessed that the information could belong to the attacker. The Telegram account used by the attacker also appeared in activity involving vulnerability reconnaissance against a digital asset trading service and an attack on what was believed to be a Chinese payment platform. Investigators also found conversations supporting a financial motive. The attacker reportedly asked Claude where information leaked in South Korea was typically traded and requested help finding Telegram chat rooms selling South Korean data.

Basic Access Controls Had Failed Before AI Entered the Attack

Lax corporate security management also contributed to these attacks resulting in actual data breaches. The incidents in South Korea's financial sector exposed weaknesses in authentication and access controls for lookup services used by loan solicitors and mobile work-support systems for employees. Routes remained open that allowed loan application records to be viewed without identity verification or outsiders to access employee services. The findings prompted criticism that ancillary business systems handling customer information had fallen into security inspection blind spots. Financial Services Commission Chairman Lee Eog-weon also rebuked financial institutions for shortcomings in even the fundamentals of their response during a parliamentary audit by the National Assembly's National Policy Committee on October 8. Regardless of the evidence of AI use, basic controls governing who could access what information had failed to function properly.

Experts say organizations must continue checking for vulnerabilities as systems change, even after completing security assessments. New services, software updates and changes to contractors' access privileges can introduce weaknesses that earlier inspections did not uncover. In an environment where AI is used to identify vulnerabilities, concerns are particularly acute that business websites and external network connections omitted from assessments may also be exposed to attack. Experts are calling for organizations to add servers and accounts created between periodic inspections to their management inventories and track whether identified vulnerabilities have been remediated. The U.S. National Institute of Standards and Technology (NIST) likewise includes identifying systems requiring updates, setting priorities and verifying successful installation as part of security update management. For systems that cannot be updated immediately, it recommends interim safeguards such as isolation to reduce exposure until remediation is complete.