AI-powered cyberattacks on websites surge

Cyberattacks on companies through online platforms have more than doubled compared to last year, according to Macnica, a prominent Japanese cybersecurity firm. This year has seen 216 incidents involving confirmed or suspected data breaches, marking a 2.6 times increase from the total for the entire previous year. Traditionally, identifying weaknesses in individual websites required significant time and resources.

However, advancements in artificial intelligence have made it easier for attackers to locate vulnerabilities. At a recent cybersecurity ministerial meeting, officials shared an analysis indicating that hackers are increasingly targeting web-based systems to identify entry points and swiftly steal personal data. A government official confirmed that AI is likely being employed in these attacks.

Macnica's data shows a sharp rise in publicly reported data breaches starting this summer, with 101 cases reported alone in October. Notable recent incidents include a suspected breach at software company Sourcenext, which may have exposed approximately 22.5 million customer records, and Skyticket, a travel booking website that disclosed extensive customer information leakage.

These attacks exploit direct weaknesses in websites and apps, enabling hackers to access information without compromising a company's internal network. In some cases, attackers impersonate legitimate users to view unauthorized customer data. Targets have become more diverse, encompassing various services beyond e-commerce sites, such as membership websites and booking platforms.

Data breaches or suspected leaks have been reported at seemingly innocuous services like library catalog systems, sightseeing train seat reservations, and university facility booking systems. Fixing vulnerabilities in individual websites may not be as simple as updating commonly used software. Macnica's Yutaka Sejiyama noted that attackers exploit blind spots in security measures and stressed the importance of identifying and addressing weaknesses in a company's systems.

Hiroshi Tokumaru, a director at EG Secure Solutions, a Tokyo-based cybersecurity firm, emphasized that security measures are often deprioritized for websites that do not handle confidential information or financial transactions. He observed that as AI advances, previously time-consuming attacks have become more accessible, shifting the balance of power between attackers and defenders.