Japan is facing a surge in cyberattacks that has exposed millions of customer records, including driver’s license images and contact details, according to an October 9 Reuters report. 

The attacks are prompting stronger protections because sensitive identity data can be used for fraud and identity theft. Cybersecurity experts also warn that AI may be lowering the barrier for cybercrime by automating tasks such as vulnerability scanning and phishing.

Major companies including Daiwa Securities, SoftBank and Lawson have reported recent breaches, while Japan’s Financial Services Agency has asked financial institutions to move away from uploaded identity-document photos and use chip-based verification.

Japan’s government has responded with new cybersecurity warnings and is pushing organizations to strengthen security controls, including across their supply chains. 

Identity Data Becomes a Growing Liability

According to a report by The Next Web, one recent breach involved a large collection of digital driver’s license images held by car-sharing service Times Car. Japan’s Financial Services Agency has asked financial institutions to move away from uploaded identity-document photos and use chip-based verification, such as reading the embedded chip in a passport or My Number card.

The scale of the incidents shows how a single compromise can expose large volumes of information that organizations collect for identity verification, customer service and other business processes.

For chief data officers (CDOs), that creates a question beyond whether cybersecurity controls are strong enough. Organizations also need to know what sensitive data they hold, where it resides, who can access it and whether every system handling that information has appropriate controls.

AI Raises the Stakes for Data Protection

The attacks are occurring as cybercriminals increasingly use AI to automate parts of their operations. 

Reuters reported that cybersecurity researchers have identified attackers using AI tools to scan for vulnerabilities and develop phishing campaigns, lowering the technical barrier for people who previously may not have been capable of carrying out sophisticated attacks. 

Authorities are still investigating whether AI was used in many of the Japanese breaches.

If attackers can identify weaknesses faster and conduct campaigns at greater scale, data protection cannot depend solely on responding after an intrusion has occurred. 

CDOs therefore have a role in making sensitive-data governance more resilient. That includes maintaining accurate data inventories, classifying high-risk information, limiting unnecessary access and establishing clear retention and deletion practices.

The Japanese incidents also highlight why data governance increasingly overlaps with cybersecurity. Protecting data starts with understanding what an organization has and how that information moves through its systems, vendors and business processes.