A Run of Unauthorised Access in Japan: What Should You Check on Your Own Website?

The short answer

News of data leaks caused by unauthorised access naturally makes you wonder whether your own website is safe. But checking that the site still loads as usual is not the check that matters.

What needs checking is not only the public pages but also the admin screens and data entrances behind them. Even if you cannot run technical checks yourself, you can organise the questions to ask whoever manages the site or your maintenance company.

What was announced recently?

On 8 October 2026, JPCERT/CC, Japan's computer emergency response coordination centre, published an alert about a run of unauthorised access cases at organisations in Japan, and updated it on 9 October. Besides apps for the general public, it covers damage involving employee management systems and BI tools used to analyse data. It does not say that the same attack method was used in every case.

The lesson for your own checks is not to limit the scope to "the website our customers see".

There are other entrances behind the site

For example, when a user picks a date and time on a booking site, that information is sent to a server. The server checks availability and sends back the result.

The entrance systems use to exchange this kind of information is called an API. Even when no button appears on screen, the server may still have an entrance that performs the action.

So hiding an action on screen is not enough. The server side also needs to check who is making the request and what that person is allowed to do. A receptionist can view bookings but cannot change the permissions of every user: the idea is to allow only the actions each job needs.

Is "we never shared the URL" access control?

Even if only your own staff know the address of the admin screen, that alone does not necessarily keep outsiders out.

Knowing a URL and being permitted to perform an action are two different things. Admin screens and APIs need proper authentication and permission checks.

Here, authentication means confirming who someone is, and a permission check means confirming which actions that person may perform. Not everyone who can sign in needs to be allowed to do everything.

What to confirm with the person in charge

Start by confirming these four points.

• Scope: is there a list of what is managed, such as the public site, admin screens and booking system?
• Updates: is it clear which software is in use and who handles security updates?
• Access restriction: do admin functions and APIs check each user's permissions?
• Records and contacts: are there logs for investigating suspicious activity, and a contact for when something goes wrong?

These are a starting point for checking. Getting answers to all four does not by itself prove that you are safe.

A message to send to your maintenance company

We would like to review the security management of our website and related systems.
Please tell us what is in scope, the update status, access restrictions on the admin screens and APIs, how logs are kept, and who to contact if something goes wrong.
Please also list separately any items that have not been checked and any that need further inspection.

If suspicious access is found, contact the person in charge before deleting any records or making a series of changes based on guesses about the cause.