Japan's IT capabilities are so abysmal that the country is now being treated like a low-level mob for hackers to farm for easy gains.

"Hacking Japanese companies has become a full-fledged sport now"

A few days ago, a user on Reddit posted this comment out of emotion. It all started when he scrolled through a page of Japanese news filled with headlines like "Company X has been hacked, data may be leaked".

For example, on October 5, the chain yakiniku restaurant "Yakiniku King" issued an apology, stating that more than 10.78 million member records on its official app were at risk of leakage;

Four days later, Skyticket, the flight and hotel booking platform, followed immediately, announcing that 14.64 million of its user data entries were also suspected to be leaked;

On the same day, second-hand book giant Bookoff also confirmed that 6.43 million pieces of its data might have been exposed.

In just 4 days, data of over 30 million members from three companies faced leakage risks.

And this is just the tip of the iceberg.

According to statistics compiled by Jiji Press and security vendor CS2, from September 25 to October 9, more than a dozen well-known Japanese enterprises and institutions have announced that they were hacked and their data was suspected to be leaked.

Alright alright, now even the bowing apologies have to come in groups...

Facing this massive "hacking movement", Japan's Chief Cabinet Secretary could only state that it is still unclear whether there is any connection between these incidents; while the National Police Agency's investigation into the attack methods is reportedly not going to release results until March 2027.

Come on man, by that time even the second season of a documentary about this would have come out, right?

At this point you might be wondering, why is there such a sudden massive wave of hacking attacks targeting enterprises?

If you ask for our bold opinion, AI must be behind all this.

Although the official investigation has not yet confirmed whether the hackers used AI, the trend is already very obvious:

The Japanese police have previously arrested several teenagers who used ChatGPT to hack Japanese enterprises; on October 14, Japanese security company Scutum also released an official post confirming that at least 3 IP addresses are using AI Agents to attack Japanese corporate websites, and one of the IPs smoothly switched between more than ten hacking tools within 8 hours.

But here comes another question: AI-powered hackers are everywhere in the world, why are they specifically targeting Japanese enterprises and relentlessly exploiting them?

Sorry, half of the blame should be put on the Japanese side itself.

First of all, the IT infrastructure of many Japanese enterprises is outdated, and their security management has long been lagging behind.

On September 28, Shueisha, the leading publisher in the manga industry, announced that it was hacked, and the cause was a configuration error in the CMS of its blogger management system. CMS is the content backend of a website, which reserves a dedicated port for program docking. It was supposed to verify identities before granting access, but the wrong settings allowed hackers to bypass the checks and create an administrator-level account for themselves.

This is just like the access card machine in an office building being set incorrectly: originally only the property management could make access cards, but passersby could swipe their cards there and get a full-access pass to the whole building.

According to statistics from Japan's National Police Agency, there were 123 ransomware cases in the first half of this year, hitting the highest record ever recorded, and half of the victims were breached through their VPN devices.

To be honest, if you have used Japanese websites before, you will not be surprised by this result.

The pervasive millennium-era vibe always makes people feel like they have traveled back 20 years in time.

To put it bluntly: The IT technology and security awareness of these enterprises are extremely backward...

The official website of the Japan Meteorological Agency

Some netizens complain that in 2026, many Japanese websites still do not allow special characters such as *, !, : in passwords, and the password length is limited to 8 to 12 digits, as if they are afraid that hackers do not have enough computing power for brute force cracking;

Others say that passwords on some large corporate platforms are exactly the same as usernames, and people there are still obsessed with an ancient "PPAP" ritual: they first send you an email with an encrypted ZIP archive, and then immediately send a second email that sends the decryption password in plain text.

What is the difference between this and pressing your key under the doormat and sticking a note that says "the key is under the doormat"?

Some people also say that a manufacturing company refuses to upgrade its ERP system (enterprise management software) under any circumstances, forcing employees to continue using Windows 7 in virtual machines, but Windows 7 stopped receiving security updates back in 2020...

At this point you might feel confused: isn't Japan a global tech powerhouse?

Japan excels in the manufacturing sector, its products such as cars, cameras and game consoles sell well all over the world; but its software systems, especially the internal IT systems used by enterprises, are almost entirely outsourced to third-party vendors.

The Japan Information Processing Promotion Agency previously released a set of white paper data.

In the United States, 65.4% of IT talents are employed by end-user enterprises (such as in-house tech teams of banks, retailers and manufacturing plants), and only 34.6% work for outsourced IT companies.

But the situation in Japan is completely the opposite.

In 2015, 72% of IT personnel in Japan worked for outsourced IT companies; by 2020, this proportion rose to 73.6% — it even went up?!

This means that the vast majority of traditional large Japanese enterprises barely have any in-house R&D and operation capabilities.

This information asymmetry and cumbersome docking processes have led to extremely backward IT maintenance practices in these enterprises, where the unwritten rule is basically "don't fix it if it still works".

In such an environment, weird password rules and configuration errors are not surprising at all.

More critically, this full-outsourcing model is a huge serial landmine in the face of supply chain attacks: as long as one bottom-tier outsourced vendor is hacked, all its large enterprise clients will fall one after another like dominoes.

For example, from October 5 to 6, Daiwa Securities and Citizen announced one after another that their data was suspected to be leaked, precisely because the same outsourced vendor that provided their customer service systems was compromised.

Big Echo, the karaoke giant, also faced leakage risks for 8.72 million pieces of user information, which was caused by a virus infection on the computer of an employee of its outsourced vendor.

Logically speaking, with such outdated IT systems and poor security management, Japanese enterprises should have had security incidents long ago. Why are all these breaches happening in a concentrated manner right now?

We think it is because the capabilities of AI models have reached a whole new level.

In the past, hackers simply did not have enough energy to crack every enterprise one by one. They would definitely target high-value targets after putting in so much effort, right? Many low-priority enterprises managed to survive until today just because "hacking them is not cost-effective".

But with the arrival of AI, no one cares about cost-effectiveness anymore. The marginal cost for hackers to attack one more enterprise is almost zero.

Besides, all the tricky problems that used to come after scanning for vulnerabilities — such as exploiting the vulnerabilities, figuring out what data to look for after gaining access, and figuring out which tool to switch to when the current one does not work — all required hackers to operate manually step by step in front of the computer. One person could not hack more than a few enterprises in a single day.

Now these steps can all be handed over to AI Agents, which can keep trying to breach enterprises one after another 24 hours a day.

The number of attack source IPs targeting SQL injection attacks on Japanese e-commerce platforms has surged 16 times within two months

Secondly, AI has completely removed the threshold for becoming a hacker.

In the past, to be a hacker you needed to understand underlying architecture, assembly language, and vulnerability mining; now you only need to know how to chat with AI, and you can get the capabilities of a hacker.

As mentioned earlier, the Japanese police have arrested quite a number of underage cyber criminals who used AI to commit crimes.

In February 2025, the Tokyo Metropolitan Police Department arrested 3 junior and senior high school students aged between 14 and 16. They used AI to write an illegal login program, hacked into other people's Rakuten Mobile accounts, frantically activated new SIM cards and resold them.

In December, Japanese internet cafe chain "Kaikatsu CLUB" announced that 7.29 million member information entries had been leaked. It was later found that the perpetrator was a 17-year-old high school student in Osaka, who used ChatGPT to improve his attack program. There was even a 6th grade primary school student in his crime group.

Yep, AI has achieved tech egalitarianism, and also achieved crime egalitarianism.

In the past if you were a noob, you could only type 666 on the keyboard; now if you are a noob, AI will teach you step by step to write scripts that land you in jail.

On one side there is the rapid development of AI technology, on the other side there are terrible IT infrastructures.

Japan has thus become the perfect newbie village for hackers.

Although this story sounds like a Japan-only joke, this hacking movement will definitely not stop at Japan.

The evolution speed of the large model industry is too fast:

For example, the reverse engineering tool REA that topped the GitHub trending list in early October, some netizens used it to crack the access control app of their residential compound, and others used it to