What Is the Real Reason Behind the Sharp Rise in Data Breaches? An Explanation of the Measures Companies and Individuals Should Take in the Age of AI

In recent years, there has been a series of large-scale data breaches in Japan.
In particular, since the start of 2026, many companies have disclosed personal data breaches, and it has been reported that the total number of cases has exceeded 100 million in a short period of time.

In this article, we’ll explain in detail why data breaches are surging, the underlying advancements in AI technology and the reality of cyberattacks, and the measures that companies and individuals should take immediately.

The Current Surge in Data Breaches and What Makes Them Truly Alarming

In recent data breach incidents, numerous companies have disclosed the leakage of personal information.
In particular, the leakage of identity verification documents—in addition to member information and email addresses—has become a major social issue.

Large-Scale Data Breach in a Car-Sharing Service

One high-profile incident was a large-scale data breach involving a car-sharing service. The
leaked information included the following, causing widespread concern among many users.

• Name
• Address
• Email Address
• Phone number
• Driver's License Image

In particular, a driver’s license photo is critical information that can be used for identity verification; if it is misused, there is a risk that a credit card could be opened or various contracts could be entered into without your knowledge.

The Truth Behind the Fearsome “Delayed Attack”

Many people tend to be on guard only immediately after a data breach is discovered.
In reality, however, there are cases where leaked information is misused years later.

There have been cases where, seven years after a driver’s license was lost, it was misused to sign a high-cost smartphone contract without the owner’s consent.
We cannot simply say, “It’s okay because no harm has been done yet.” The most frightening aspect of data breaches is that once personal information is leaked, it can circulate on the black market virtually indefinitely.

Why have data breaches been on the rise recently?

The rapid advancement of AI technology has been cited as a factor behind the sharp increase in data breaches.

Generative AI systems such as ChatGPT and Claude typically have built-in safety measures and will not respond to questions that could facilitate criminal activity.
However, in recent years, a system known as “local AI” (or “local LLM”)—which allows users to run AI models publicly available on the internet on their own computers—has become increasingly popular.

While this technology is primarily useful for securing internal information, generating images, and improving operational efficiency, some AI models with safety controls removed are circulating, and concerns have been raised that these could be exploited for cyberattacks.

Three Risks of AI-Driven Cyberattacks

While traditional hacking relied primarily on human effort, attacks that utilize AI have the following characteristics:

1. It operates 24 hours a day, 365 days a year, without taking
   breaks, constantly searching for vulnerabilities in corporate systems.
2. Unparalleled Processing Speed
   : Research that would take humans several weeks could potentially be completed in a short amount of time using AI.
3. Capable
   of large-scale attacks: A single AI can analyze multiple systems simultaneously and detect vulnerabilities.

As a result, companies whose security measures are lagging behind are more likely to be targeted.

Measures Companies Should Take to Prevent Data Breaches

In the age of AI, the concept of “fighting AI with AI” is crucial.
Companies need to use AI to identify vulnerabilities in their systems before they come under attack and strengthen their security from within.

• We will review our personal information management practices. Important information, such as driver’s
  licenses, will not be stored in the same location as general customer information; after identity verification, it will be transferred to an offline environment. We will also strictly enforce access controls, implement encryption, and conduct regular audits.
• Strengthening Security Audits: Establish a system to conduct
  regular third-party audits to identify and address system vulnerabilities.
• Since many
  data breaches stem from human error, we make sure to provide cybersecurity training to our employees.

Measures Individuals Can Take to Prevent Data Breaches

In addition to measures taken by companies, individual precautions are also extremely important. Be sure to thoroughly implement the following measures.

• Stop
  Reusing Passwords: It has been reported that about 85% of Japanese people reuse their passwords. If information is leaked from
  one service, there is a risk of unauthorized access to other services—such as Amazon, Google, Rakuten, and social media platforms—where you use the same password. Therefore, be sure to set a different password for each service.
• Since a
  password alone is not enough, we enhance security by using two-factor authentication in combination with an authentication app or SMS verification.
• Taking advantage of data breach
  incidents involving suspicious emails, there has been an increase in phishing scam emails disguised as “apologies for data breaches,” “notices regarding compensation,” and “requests to change passwords.” Do not click on any URLs
  in these emails; instead, access the official website directly.

Challenges in Japan’s Measures to Prevent Data Breaches

The European Union (EU) has implemented a strict personal data protection system known as the GDPR, under which companies that violate the regulations are subject to massive fines.

In Japan, however, a relatively large portion of the responsibility is left to the discretion of individual companies, and discussions continue regarding clear security standards and stringent penalties.
Going forward, it will be necessary not only for companies but also for the nation as a whole to move forward with establishing cybersecurity regulations.

Summary | Act on the Assumption That “Information Might Leak”

Data breaches are no longer a problem limited to just a few companies.
As AI technology advances, cyberattacks are becoming more sophisticated, and the damage they cause is likely to increase in the future.

• The Rise of Attacks Involving the Misuse of AI
• The Risk of Personal Information Being Misused Years Later
• The Need for Both Companies and Individuals to Strengthen Their Measures

In the coming era, it’s important to act on the assumption that “information may be leaked.” Companies must strengthen their security using AI, while individuals must thoroughly manage their passwords and take measures against phishing.
To minimize damage, take a moment right now to review your own security measures.