IT technology is so bad, Japan is being treated as a monster by hackers...

Abstract:

"

Black Japanese companies have become a sport"

For example, on October 5, the barbecue restaurant chain "Shaobao King" apologized, saying that more than 10.78 million member information of its own app may have been leaked;

Four days later, Skyticket, which book flights and hotels, immediately followed up and told me that 14.64 million pieces of information may have been leaked;

On the same day, second-hand book giant Bookoff also said that 6.43 million data may have been leaked.

In just 4 days, 30 million member information of three companies was at risk of being leaked.

And this is just the tip of the iceberg.

According to a summary by Jiji News Agency and security vendor CS2, from September 25 to October 9, more than a dozen well-known companies and institutions in Japan announced that they had been hacked and their data was suspected of being leaked.

Okay, okay, now I have to form a group to bow and apologize...

In the face of this massive "hacker movement", Japan's Chief Cabinet Secretary can only say that it is not clear whether the incidents are related; and the National Police Agency's investigation of attack methods is said to not have results until March 2027.

No man, the documentary must have released its second season at that time.

After seeing this, you may be curious, why did such a large wave of hackers suddenly break into companies?

There must be something behind the theory of extreme violence in the world

AI

.

Although the official investigation has not yet found out whether hackers have used AI, the trend is already obvious:

The Japanese police have previously arrested several teenagers who used ChatGPT to invade Japanese companies; on October 14, the Japanese security company Scutum also issued a report stating that at least three IPs were using AI Agent to attack Japanese corporate websites, and one of them smoothly switched between more than a dozen hacking tools within 8 hours.

But the problem comes again. AI hackers are everywhere in the world. Why do they only catch Japanese companies to kill them?

Sorry, half of the blame has to be shouldered by the Japanese.

First of all, many Japanese companies have old IT infrastructure and long-term backward security management.

On September 28, Shueisha, a leader in the comics industry, announced that it had been hacked due to an incorrect CMS configuration of its blogger management system. CMS is the content backend of the website. It leaves a special opening for program docking. Originally, the identity must be verified before release, but the settings were wrong. The hacker bypassed the check and opened an administrator-level account for himself.

It's like the access control card machine in an office building was set up incorrectly. Originally, only the property owner could apply for a card. However, a passerby stood over and swiped the card, and then he got himself a building access card.

According to statistics from the Japanese National Police Agency, there were 123 ransomware cases in the first half of this year, setting a record since statistics began, and half of the victims' breaches were VPN devices.

To be honest, if you have used Japanese websites, this result will not be surprising.

The breath of the millennium always makes people feel like they have traveled back twenty years.

To put it bluntly:

The IT technology and awareness of enterprises are very backward...

Japan Meteorological Agency official website

Some netizens complained that it is 2026, and many Japanese website passwords are still not allowed to use special characters such as *, !, :, etc., and the length is limited to 8 to 12 characters, for fear that hackers will not have enough computing power when brute force cracking;

Some people say that the passwords and usernames of some large companies are exactly the same, and they are still obsessed with the ancient ritual of "PPAP", which is to first send you an encrypted ZIP compressed package email, and then send you a second email with the unzipped password in plain text.

What's the difference between this and putting the key under the doormat and then posting a note saying "The key is under the doormat"?

Some people also say that a certain manufacturing company refuses to upgrade its ERP system (enterprise management software) and allows employees to continue using Windows 7 in virtual machines. However, Win7 stopped security updates as early as 2020...

You may feel confused after seeing this: Isn’t Japan a technological power?

Japan is strong in manufacturing, such as cars, cameras, and game consoles, which can be sold all over the world;

but software systems, especially IT systems used internally by companies, are almost all handed over to outsourcing companies.

Japan’s Information Processing Promotion Agency previously issued a set of white papers.

In the United States, 65.4% of IT talents are employed by major user companies (such as banks, retailers, and manufacturing plants with their own technical teams), and only 34.6% are in outsourced IT companies.

But Japan is completely the other way around.

In 2015, 72% of Japan’s IT personnel were outsourcing IT companies; by 2020, this proportion was 73.6%. Can it still rise? !

This means that the vast majority of large traditional Japanese companies have almost no internal R&D and operation and maintenance capabilities.

This kind of information asymmetry and cumbersome docking process have caused enterprises to be extremely backward in IT maintenance. It is almost "if it can be used, don't do it."

In such an environment, it is not surprising that there are weird password rules and configuration errors.

More importantly, this full-staff outsourcing model is a super chain mine in the face of supply chain attacks: as long as a bottom-level outsourcer is breached by hackers, its large corporate customers will fall one after another like dominoes.

For example, from October 5th to 6th, Daiwa Securities and Citizen announced that their data might be leaked because the same outsourcer that provided them with their customer service systems was compromised.

8.72 million messages from karaoke giant Big Echo may have been leaked, also due to a virus on the computer of an employee of the outsourcer.

It stands to reason that since Japanese corporate IT is so old and security management is so backward, something should have happened a long time ago. Why is it happening now?

Shichao feels that the capabilities of the AI ​​model have risen to another level.

In the past, hackers didn’t have that much energy to crack companies one by one. I must be trying to get something good, right? Many companies have survived today by relying on "low cost performance".

But

AI

First of all, who is more cost-effective than you two? The marginal cost for a hacker to attack one more company is almost zero.

Moreover, in the past, the problems after scanning for vulnerabilities, such as how to exploit vulnerabilities, what data to find after hacking, and which tools should be used, all required hackers to sit in front of the computer and manually operate step by step. One person could not attack several hackers in a day.

But now these steps can also be handed over to the AI ​​Agent, and the AI ​​can try them one after another 24 hours a day.

Aiming at Japanese e-commerce SQL injection attacks, the number of attack source IPs surged to 16 times in two months

Secondly,

AI

The threshold for becoming a hacker has also been eliminated.

In the past, to be a hacker, you had to understand the underlying architecture, assembly, and vulnerability mining; now you only need to know how to chat with AI to become a hacker.

As mentioned before, the Japanese police have arrested many people

AI

The cybercriminal was a minor.

In February 2025, the Tokyo Metropolitan Police Department arrested three middle and high school students aged only 14 to 16 years old. They used AI to write an illegal login program, log in to other people's Rakuten Mobile accounts, frantically opened mobile phone cards and then resold them.

In December, the Japanese Internet cafe chain "Happy CLUB" announced that the information of 7.29 million members was leaked. It was later discovered that the initiator was a 17-year-old Osaka male high school student. He used ChatGPT to improve the crime procedure. There was even a sixth grader in the crime group.

Well, AI has achieved technological equality and criminal equality.

In the past, you were a novice, and you could only press 666 on the keyboard; now you are a novice, and AI will teach you how to write scripts and enter the game step by step.

One side is

AI

The rapid development of technology is accompanied by poor IT infrastructure.

Japan has become a novice village for hackers.

Although this story may sound like a Japanese-only joke, this movement certainly doesn’t stop in Japan.

The evolution of the large model industry is still too fast:

For example, REA, the reverse engineering tool that topped the GitHub hot list in early October, was used by some netizens to decipher the community access control app, and someone reversed the Bluetooth protocol of the toilet applet in half an hour. (see details).

When ordinary people can crack software and protocols in half an hour, will they be able to crack factory assembly line control terminals and old systems in hometown hospitals in the future?

Once the AI ​​hackers get enough experience in the Novice Village one day, the next map that gets maxed out will just be any weak corner in the world that is still lucky enough to think that no one will notice.

After all, there is never a hunter who lacks meat, only prey that has not had time to hide.