Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks

JPCERT/CC has warned that a wave of personal data breaches hitting Japanese organizations stems from abuse of mobile app management APIs and exploitation of a critical Metabase SQL injection flaw, CVE-2026-72898 (CVSS 10.0). Attackers reverse-engineer smartphone apps to find hidden API endpoints, exploit internal APIs to escalate privileges or create rogue accounts, and reuse stolen API keys from other breaches; some also hit vulnerable admin panels and known software bugs. Security firm Macnica counted 119 similar incidents in Japan so far in 2026, up sharply from 84 in 2025, including major leaks at Times Car (around 8 million accounts combined) and the Yakiniku King app (over 10.7 million records). Metabase has urged users to upgrade to its listed minimum safe releases (e.g., 0.63.13, 0.62.16, 0.61.18) since attacks on the unpatched flaw continued even after the August fix, and Japan's privacy regulator has separately issued guidance on API-related data leaks.