Cyberattacks on Japanese firms focus on subsidiaries

A series of major cyberattacks targeting prominent Japanese companies over the past two weeks has exposed the data of millions and revealed a common security vulnerability: attackers are increasingly breaching organizations through their subsidiaries, overseas operations, and third-party technology partners rather than corporate headquarters. The incidents, which affected companies in insurance, telecommunications, manufacturing, and brewing, underscore the expanding digital attack surface for large enterprises.

The largest disclosed breach involved Aflac Life Insurance Japan. The company announced that attackers gained unauthorized access to its policyholder portal between June 15 and June 25, compromising the personal information of approximately 4.38 million customers and agents. The exposed data includes names, addresses, phone numbers, dates of birth, and insurance account information. For about 230,000 individuals, bank account details used for premium payments were also accessed. Aflac stated the incident was contained to its Japanese operations and did not affect its U.S. business. The company has engaged cybersecurity experts and notified authorities.