🗂️ CASE FILE — October 12, 2026
Lead story: A breach wave across Japan and South Korea has pushed past 10.8 million confirmed leaked records and counting. On October 5, 2026, Monogatari Corporation — operator of the Yakiniku King restaurant chain — disclosed that 10,788,963 records were exfiltrated from the Yakiniku King app's member system: 99.8% of the 10.8 million registered users, including member numbers, names, email addresses, and phone numbers. Days earlier, Park24 confirmed that roughly 6.6 million accounts were pulled from the web system of its Times Car car-sharing service, with driver's license images among the documents taken from about 1.6 million of those accounts. The tally keeps growing: Asahi Kasei Therapeutics (~558,000 healthcare professionals plus 700 employees potentially affected), MrMax Holdings (up to 1.73 million), GMO Research & AI (~940,000 plus roughly $18,100 in stolen loyalty points), Citizen Watch (~100,000 inquiry records), and Daiwa Securities (220,000 records). Across the strait, seven South Korean financial institutions — including Shinhan, KB Kookmin, and Hana banks — disclosed customer data leaks. Investigators are increasingly pointing at AI-assisted attack tooling: Cisco Talos assesses with moderate-to-high confidence that ransomware-deployment tooling used by Qilin affiliates in Japan was AI-generated, and CrowdStrike found traces of the Chinese AI pentest tool ARTEX and Claude Code sessions on servers tied to the South Korean bank attacks.
Why it leads: Scale, pattern, and method. Monogatari alone is one of Japan's largest consumer breaches of the year — and Macnica counts 119 similar web data-leak incidents in 2026 (81 since July, already exceeding 2025's 84), with 99 lookalike cases in 13 other countries and regions and 30 of them in South Korea, suggesting a shared technique rather than isolated bad luck. Trend Micro reports Japanese companies and local governments disclosed 600 unauthorized-access incidents through September, already topping all of 2025's 593. Meanwhile the AI layer is no longer theoretical: forensic artifacts show attackers using LLMs to generate ransomware operators, build phishing sites in under 30 minutes (a task that took two researchers roughly a week), and run attack infrastructure — while South Korea's Financial Services Commission chair used an October 8 parliamentary audit to rebuke banks whose basic access controls — identity verification on lookup services — had failed before any AI entered the picture.
Today's top stories
- Japan–Korea breach wave: 10.8M+ records out — Monogatari (10,788,963), Times Car (6.6M, incl. driver's license images), Asahi Kasei, MrMax, GMO, Citizen Watch, Daiwa leak; seven South Korean banks and consumer finance firms hit; Talos and CrowdStrike flag AI-generated attack tooling. (Japan, South Korea — critical)
- Warlock ransomware rides year-old SharePoint flaws into critical infrastructure — Symantec reports the China-linked group (aka Longlegs/Storm-2603) hit a water utility, a telecom, a regional government body, and a university via the ToolShell chain and newer CVE-2026-45659 (now in CISA KEV); in one intrusion, EDR-killers hit 40+ hosts in ~2 hours, ransomware deployed to 33 via SYSVOL. (ransomware, critical infrastructure)
- Q3 2026 sets ransomware record: 2,627 claimed attacks — Comparitech's early-October tracker counts the highest quarterly total on record; fewer than 1 in 10 victims publicly confirm, so the real number is higher. (Industry)
- Rhysida and Majinahanashi post fresh claims — Rhysida says it took ~96,500 files from Louisiana law firm Charles E. Tabor AAL LLC; Majinahanashi claims an attack on CARIBE/SUBRA. Both remain unverified leak-site claims. (United States, ransomware)
Incident timeline
| Date | Event |
|---|---|
| Sep 28, 2026 | Park24 says a third party obtained data on ~6.6M Times Car accounts from the service's web system |
| Sep 29, 2026 | Park24 adds that identity documents, including driver's license images, leaked from ~1.6M accounts |
| Sep 30, 2026 | Yegaram Savings Bank (South Korea) detects indications of a server intrusion; ~40,000 customers estimated affected |
| Oct 2, 2026 | Monogatari confirms unauthorized access to the Yakiniku King app member system; Asahi Kasei's contractor reports suspicious activity on Pharma DIGITAL, site suspended |
| Oct 3, 2026 | Monogatari confirms the Yakiniku King member data leak |
| Oct 5, 2026 | Monogatari publicly discloses 10,788,963 leaked records |
| Oct 6, 2026 | Asahi Kasei Therapeutics (~558,700 potentially affected) and MrMax Holdings (up to 1.73M) disclose; Daiwa, GMO, Citizen Watch disclosures surface |
| Oct 8, 2026 | South Korea's FSC chairman rebukes financial institutions over access-control failures at a parliamentary audit |
| Oct 12, 2026 | Trend Micro's 600-incident figure, the CrowdStrike ARTEX findings, and the Warlock Q3-context reporting all land |
Japan–Korea breach wave: 10.8M+ records out, attackers wield AI
Monogatari's disclosure is the anchor. Unauthorized access to the official app's member management system was detected October 2; communications were blocked and defensive measures applied, but the leak was confirmed October 3 and disclosed October 5: 10,788,963 of 10,808,784 registered users exposed — member numbers, names, email addresses, and phone numbers. The company says login passwords, dates of birth, gender, postal codes, points balances, and payment data were not in the leak, and that no misuse has been confirmed. Japanese media note it as unprecedented in the chain's history.
Times Car's leak is the more sensitive of the two. Beyond the ~6.6M accounts, the leaked set included names, addresses, dates of birth, telephone numbers, driver's license information, and identification document images — and the victims included not just current members but former members and applicants who never completed registration. Around the edges: Asahi Kasei's Pharma DIGITAL database held names, affiliated medical institutions, clinical departments, and some email addresses of ~558,000 healthcare professionals; MrMax's server breach put up to 1.73M app and online-store users at risk; GMO Research & AI lost up to ~940,000 records and ~$18,100 in membership reward points; Citizen Watch's inquiry-contractor server put ~100,000 at risk (with possible bank/card details included in inquiry text); Daiwa Securities leaked 220,000 records, 110,000 with names, emails, and account numbers.
South Korea's seven institutions: Shinhan Bank (~25,000 customers — names, contact details, annual incomes, loan limits, plus 66 resident registration numbers and 97 personal identification codes); KB Kookmin Bank (119 customers via an employee mobile work-support system); Hana Bank (89 customers, RRNs exposed); BNK Busan Bank (11 outsourced development staff); Yegaram Savings Bank (~40,000); Hyundai Capital (146 solicitors, RRNs exposed); and Welcome Savings Bank, bringing the count to seven.
Investigation notes
- The pattern is the story: Macnica's count — 119 similar web data-leak incidents in Japan in 2026 (81 since July), driven by mobile API abuse and Metabase attacks — plus 99 similar cases in 13 other regions (30 in South Korea, 11 in France, 8 in Poland) points to a replicable technique targeting member-service web systems, not seven separate incidents. Trend Micro's 600-incident figure for Japan through September already exceeds 2025's full-year 593.
- AI-generated attack tooling, forensically backed: Cisco Talos found Python programs on a Qilin-used server in Japan — tooling to deploy ransomware across machines, destroy data on schedules, and disable backups — whose comments, formatting, and logs it assesses as likely AI-written at moderate-to-high confidence. CrowdStrike found ARTEX (a Chinese AI pentest tool) connected to a DeepSeek model plus Claude Code sessions on servers tied to the South Korean attacks, with traces of GLM and Grok use — and a résumé typed into Claude describing a 26-year-old in Maoming, Guangdong, with a South China University of Technology background, that investigators believe may be the attacker. Trend Micro's lab test: an AI tool profiled a target and built a phishing site in under 30 minutes — work that took two researchers about a week.
- The unglamorous half of the failure: South Korea's bank breaches traced to routes with no identity verification on loan-application and solicitor lookup pages, and outsiders reaching employee-only services. The FSC chairman's October 8 rebuke frames this as a fundamentals failure — AI makes exploitation faster, but the doors were open before it arrived.
Warlock ransomware rides year-old SharePoint flaws into critical infrastructure
Symantec's threat-hunter team reports that the China-linked Warlock operation (also tracked as Longlegs and Storm-2603) breached at least four organizations across water utilities, telecommunications, regional government, and higher education over two months ending October 1, 2026 — concentrated in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America. The attackers needed no new vulnerability: they reused the ToolShell on-premises SharePoint chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) first exploited in July 2025 — patches admins have had 15 months to apply — alongside newer SharePoint flaws, with CVE-2026-45659 now in CISA's Known Exploited Vulnerabilities catalog.
One intrusion (July 22–31) shows the kill chain: a vulnerable K7RKScan driver (BYOVD) was used to kill endpoint protection on at least 40 hosts within about two hours, then Warlock ransomware was staged in the domain SYSVOL share and deployed to 33 hosts — domain replication delivering the payload to machines. The group also used Visual Studio Code tunnels for command and control, per Symantec and Carbon Black research.
Investigation notes
- The Microsoft patch-and-rotate gap: Microsoft's ToolShell guidance calls for rotating SharePoint ASP.NET machine keys after patching — the EU's joint technical assessment of the 2025 incident flagged key rotation as a mandatory recovery step, not optional hardening. Warlock's continued success suggests many shops patched but never rotated.
- Attribution discipline: "China-linked" is Symantec's assessment (Storm-2603 tracking); it is not a public government attribution. Victims remain unnamed, so treat sector-and-region claims as the available resolution.
- Why it matters beyond four victims: CISA's KEV addition for CVE-2026-45659 turns this from an incident report into a compliance clock — federal agencies face binding remediation deadlines, and the critical-infrastructure target selection keeps this in the national-security conversation regardless of victim count.
Q3 2026 sets ransomware record: 2,627 claimed attacks
Comparitech's Q3 2026 ransomware tracker, published in early October, counted 2,627 claimed ransomware attacks globally — the highest quarterly figure the firm has recorded. Its report adds the crucial caveat that fewer than one in ten victims publicly confirm an attack, meaning the true count is almost certainly higher than the record suggests. Warlock's four confirmed victims sit inside that quarter, but the record is driven by volume across the ecosystem, not any single campaign.
Investigation notes
- Claimed vs. confirmed: trackers aggregate leak-site posts and victim confirmations; groups pad numbers and duplicate postings inflate counts. The trend line — record after record — is the signal; any single number is approximate.
- Defender takeaway: with disclosure rates under 10%, assume the incidents you hear about are a fraction. Patch edge appliances, verify backups are actually isolated from production identity systems (ransomware crews now target backups first), and rotate keys after patching SharePoint.
Rhysida and Majinahanashi post fresh claims
Monitoring of ransomware leak sites flagged two new claims on October 12. Rhysida alleges it stole nearly 96,500 files from Charles E. Tabor AAL LLC, a Louisiana law firm, raising concerns about sensitive legal and HR records. Separately, the Majinahanashi group claims an attack on CARIBE / SUBRA with data theft and publication threats. Both come from leak-site trackers (Ransomware.live monitoring) — neither has been independently confirmed, and leak-site copy routinely inflates scope.
Investigation notes
- Claims are leads, not breaches: no victim statement, regulator filing, or independent verification has surfaced for either claim. The alleged data categories (legal records, HR data) warrant attention because of the privacy and legal exposure they would create if proven — treat as a watch item.
- The law-firm pattern: law firms are prized extortion targets — confidential client matters, opposing-counsel strategy, and HR records create maximum pressure per gigabyte. Rhysida's claim fits that targeting profile; confirmation or denial from the firm is the next event to watch.
Sources
- The Economy — “Attack-Ready in 30 Minutes”: AI-Armed Hackers Exploit Gaps in Corporate Security (Oct 12, 2026)
- The Hacker News — Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks (Oct 8, 2026)
- National Cyber Security — Warlock Ransomware Hits 4 Sectors via SharePoint Bug (Oct 12, 2026)
- Pacific Technology Group — China's Ransomware Crew Found Your Unpatched SharePoint. It Took Nine Days to Encrypt Everything. (Oct 3, 2026)
- Undercode News — Two Ransomware Alerts Raise Concerns Over HR Data and Sensitive Legal Records (Oct 12, 2026)