Japan's computer emergency response centre, JPCERT/CC, has warned of an increase in personal data leaks affecting organisations in Japan. According to its October 8 alert, incidents have involved the abuse of APIs used by mobile applications and the exploitation of known software vulnerabilities, including attacks involving Metabase.

Although the advisory is based on incidents reported in Japan and does not name affected organisations or a specific threat actor, the patterns described are relevant well beyond one country. For European businesses, the message is practical: externally accessible APIs, unpatched web software and overly broad data exposure remain common routes to breach.

What happened

JPCERT/CC said it has observed a string of personal data leaks at Japanese organisations. The incidents were linked to two recurring issues:

• Abuse of APIs used by mobile applications
• Exploitation of known vulnerabilities in internet-facing software, including Metabase

The alert is based on incident reports received by JPCERT/CC and related information. At the time of the advisory, the organisation did not publicly attribute the activity to a named attacker and did not identify the affected organisations.

In practical terms, API abuse can happen when backend interfaces used by mobile apps are exposed with weak authentication, poor authorisation controls or excessive data returned in responses. Separately, attacks against known vulnerabilities often succeed when organisations delay patching software that is already exposed to the internet.

Why it matters for European businesses

The technical issues highlighted by JPCERT/CC are common across many markets. European companies use the same broad mix of mobile apps, SaaS platforms, analytics tools and web applications, often with APIs connecting customer-facing services, internal systems and third-party providers.

That creates several business risks:

• Customer and employee data exposure: APIs can unintentionally expose personal data if access controls are not enforced correctly.
• Expanded attack surface: Mobile apps frequently rely on backend APIs that are reachable from the internet and can be tested directly by attackers.
• Patch management gaps: Known vulnerabilities remain a major source of compromise when software updates are delayed or internet-facing systems are not fully inventoried.
• Operational and regulatory consequences: A data leak can trigger incident response costs, reputational damage, customer notifications and, depending on the circumstances, data protection obligations under EU and national rules.

The mention of Metabase is also relevant because business intelligence and reporting tools are sometimes deployed quickly for internal use and then left exposed. Even when a platform is not intended for the public, weak internet exposure, default assumptions about internal access or delayed updates can turn it into a route for broader data access.

Who may be affected

The advisory is most relevant to organisations that operate web services or mobile applications, especially where customer accounts, personal data or internal reporting systems are involved.

• Businesses with customer-facing mobile apps and supporting APIs
• E-commerce companies handling account, order and payment-related data
• SMEs relying on small IT teams and outsourced application development
• Companies using self-hosted or exposed analytics and dashboard tools such as BI platforms
• Marketing and digital teams that connect websites, apps and CRM systems through APIs
• Regulated organisations processing sensitive personal or business data

Smaller organisations may be particularly exposed where APIs were built quickly, documentation is incomplete or responsibility for patching is split between internal teams, agencies and software vendors.

What companies should consider

JPCERT/CC's alert does not create new legal obligations for European companies, but it does point to practical areas worth reviewing.

• Review API authentication and authorisation: Check that mobile and web APIs do not rely on weak tokens, predictable identifiers or client-side controls alone.
• Test for excessive data exposure: Confirm that API responses only return the minimum data needed for each function and user role.
• Inventory internet-facing systems: Identify externally accessible dashboards, analytics tools, admin panels and APIs, including systems deployed for internal use.
• Prioritise patching of exposed software: Apply security updates quickly for public-facing applications and supporting components, especially where known vulnerabilities already exist.
• Limit public exposure where possible: Restrict access to internal tools through VPN, IP allowlisting, SSO and multi-factor authentication where appropriate.
• Monitor for abnormal API activity: Look for unusual request patterns, enumeration attempts, spikes in failed requests or high-volume data extraction.
• Clarify supplier responsibility: If apps or web platforms are managed by agencies or software partners, define who owns patching, logging, vulnerability review and incident response.
• Prepare for breach handling: Ensure that security, legal and privacy teams know how to assess a suspected data leak and when notification requirements may apply.

For European businesses, the broader lesson is straightforward: API security and vulnerability management should be treated as routine business controls, not specialist edge cases. As more customer journeys, mobile services and internal analytics depend on interconnected web systems, basic weaknesses in exposed applications can quickly become data protection and continuity problems.