Brilliant Hackers or Corporate Blind Spots? Japan’s 5-Day vs. 78-Day Disclosure Gap

AI agents are making cyberattacks faster, more automated, and potentially harder to contain. Meanwhile, major organizations continue to lose enormous amounts of personal data.

But here’s a question worth asking: with security products from companies such as CrowdStrike, Microsoft, and Cloudflare available, why are even large corporations and government agencies still getting breached?

The more I examined the official records, the less this looked like a simple story about brilliant hackers. Some organizations have struggled to detect intrusions, control excessive data access, or fix vulnerabilities that were already known. And in one Japanese government case, 78 days passed between the first detected anomaly and the public announcement.

So what exactly went wrong? And when a company suffers a data breach, what does it actually have to tell the public?

4.4 Million Customers’ Data Exposed: The First Warning Was High CPU Usage

In June 2026, Aflac Life Insurance Japan Ltd., the Japanese insurance subsidiary of Aflac, suffered unauthorized access to its systems. A subsequent investigation found that personal information relating to approximately 4.4 million customers had been compromised. For roughly 220,000 of them, the exposed information included bank account details used for insurance premium payments.

What caught my attention was how the incident came to light.

According to Aflac Japan’s official FAQ, its systems detected unusually high central processing unit (CPU) usage at 6:30 a.m. on June 25. Investigators later established that the first unauthorized access had occurred on June 10.

That makes 15 days between the earliest confirmed intrusion and the system alert.

There is another revealing detail. Aflac Japan’s initial announcement on June 30 placed the first unauthorized access on June 15. Further investigation subsequently moved that date back to June 10. Even establishing when an attack began can take time.

The company said its system already had functions designed to detect and block unauthorized access. However, the attack used requests that resembled ordinary user activity, preventing immediate detection.

Its investigation also identified insufficient monitoring and controls for large numbers of data queries made within a short period.

Security reviews had been conducted during system design, and penetration testing had taken place before release. Yet the particular method used in this incident had not been adequately anticipated.

In other words, installing security technology was not enough. The system also needed to recognize when apparently normal requests were being used to access abnormal amounts of information.

Japan’s Digital Agency Knew About the Vulnerability. Public Disclosure Took 78 Days

The second case involves Japan’s Digital Agency, the government body responsible for promoting digital administration.

On September 11, 2026, the agency announced that approximately 246,000 personal-information records belonging to government personnel and related contractors might have been exposed through unauthorized access to the Government Solution Service (GSS), a shared government IT environment.

The attacker exploited a known security vulnerability in a virtual private network (VPN) device, which is used to provide network connections.

The weakness had been publicly disclosed before the attack, and the agency was aware of it. Its initial severity rating was “Medium.” The Digital Agency said it had begun addressing the issue more quickly than the general response associated with that rating, but the vulnerability was exploited before the corrective software update was installed.

This distinction matters. A known vulnerability does not automatically mean an organization deliberately ignored it. In this case, the problem was that the attackers got there before the fix.

To examine the timing, I compared the two organizations’ official records using the same starting point: the date an abnormality was first detected.

What happened?	Aflac Japan	Digital Agency
Anomaly detected	June 25, 2026	June 25, 2026
First public announcement	June 30, 2026	September 11, 2026
Elapsed time	5 days	78 days
Reported scale	Approximately 4.4 million customers’ data confirmed exposed in the subsequent investigation	Approximately 246,000 personal-information records potentially exposed

Editor’s calculation based on official announcement dates. Aflac Japan’s 4.4 million figure comes from its July 31 investigation results, not its first announcement. The Digital Agency’s figure represents records, not necessarily unique individuals, and the exposure was reported as a possibility. The elapsed times do not establish concealment, negligence, or a legal violation.

Comparison of the time from anomaly detection to first public disclosure in 2026: five days for Aflac Japan and 78 days for the Digital Agency. The Digital Agency had already reported the matter to Japan’s Personal Information Protection Commission on July 15. AI-generated illustration; buildings, people, and announcement scenes are fictional, and timeline lengths are not drawn to an exact scale.

The contrast is striking: a difference of 73 days, with the longer period 15.6 times the shorter one. But the figures require context.

The Digital Agency detected unusual access to large numbers of files on June 25, confirmed unauthorized access on July 9, and reported the matter to Japan’s Personal Information Protection Commission on July 15.

It continued investigating the possible exposure, with help from outside specialists, before making its public announcement on September 11.

That is not the same as doing nothing for 78 days. Nor does the comparison prove that one organization handled its incident more responsibly than the other.

What the comparison does reveal is a question worth asking: how much time can pass between detecting an abnormality and telling the people whose information may be at risk?

Here’s the Odd Part: Reporting to Regulators Is Not the Same as Telling the Public

Japan’s Act on the Protection of Personal Information (APPI) requires organizations to report certain serious personal-data incidents to the Personal Information Protection Commission (PPC), Japan’s national privacy regulator, and to notify affected individuals when the relevant legal conditions are met.

For private-sector businesses, the initial report should generally be made promptly, approximately three to five days after the organization becomes aware of a reportable incident.

A more detailed report is generally required within 30 days, or within 60 days for incidents suspected of involving malicious intent. Public-sector bodies are subject to separate provisions.

But reporting to a regulator, notifying affected individuals, and making a public announcement are three different things.

According to the PPC’s official FAQ, public disclosure of a data breach is not, as a general rule, mandatory under the APPI, except in circumstances where publication serves as an alternative to notifying affected individuals.

Other laws and sector-specific requirements may impose additional obligations. The PPC also explains that public disclosure may be desirable depending on the circumstances.

This does not mean a company can simply hide an incident without consequences. It means that a press release is not necessarily the legal measure by which compliance is judged.

There are legitimate reasons to withhold some details during an investigation, including the possibility of giving attackers information they could exploit.

Still, from a customer’s perspective, there is an uncomfortable gap between what an organization has reported privately to regulators and what the people whose data it holds actually know.

Perhaps the Bigger Scandal Is the Vulnerabilities Companies Already Knew How to Fix

Japan’s Personal Information Protection Commission published its fiscal 2025 annual report in July 2026. One section is particularly revealing.

In reviewing incidents caused by unauthorized access, the commission identified cases where organizations had left known vulnerabilities unresolved even though the weaknesses and available remedies had already been publicly documented.

Other problems included easily guessed passwords and incorrectly configured database access controls.

These are not necessarily the work of some previously unimaginable hacking technology. Some failures involved weaknesses for which defensive measures were already available.

The same annual report records 17,139 personal-data breach-related reports processed for private-sector businesses and similar organizations during fiscal 2025, covering April 1, 2025, through March 31, 2026.

Dividing that figure by 365 days gives approximately 47 reports processed per day. This is a simple daily average, not a claim that 47 cyberattacks occurred every day.

There is an even more unexpected number.

Of the 13,345 reports submitted directly to the PPC, 10,263 concerned paper records alone. That works out to approximately 76.9%.

So while AI-assisted cyberattacks attract the headlines, traditional problems involving paper documents, including mishandling, loss, and misdirected delivery, remain an enormous part of Japan’s reported privacy incidents.

The lesson is not that sophisticated cybersecurity is unnecessary. It is that information security still depends on the ordinary, unglamorous business of managing information properly.

Will AI-Driven Attacks Make Companies More Accountable?

In September 2026, the US-based AI company Anthropic published research into malicious use of its AI systems. It documented attackers using AI to help conduct intrusions against multiple organizations, automate technical tasks, and collect large amounts of data.

In some reported cases, breaches were completed in approximately two to three hours. That figure refers to specific incidents, not the average duration of a cyberattack.

Japan has also seen evidence of AI-assisted attack activity. In October 2026, JPCERT/CC, Japan’s computer emergency response coordination center, reported attack attempts involving the misuse of AI-enabled penetration-testing frameworks.

There is an important limitation here: the official information reviewed for the Aflac Japan and Digital Agency incidents does not establish that AI agents were used in either attack.

Still, as attackers become faster and more capable of working across multiple targets, the time available for defenders to discover and contain a breach may shrink.

Stopping an attacker at the perimeter is only part of the job. Organizations also need to spot abnormal activity inside their systems and restrict unauthorized access to, or large-scale extraction of, customer records.

Conceptual illustration of layered corporate data protection: preventing intrusions, detecting suspicious activity, and limiting unauthorized data extraction. AI-generated illustration; it does not reproduce the security architecture of any real organization.

Corporate responsibility for data protection is not a new invention of the AI era. Japan already has legal requirements concerning appropriate security measures, incident reporting, and regulatory oversight.

On July 17, 2026, Japan also promulgated amendments to its personal information protection legislation, including a financial penalty system addressing specified unlawful handling of personal information that generates financial benefits.

Most of the amendment’s substantive provisions have yet to take effect as of November 2026. The new system does not mean every organization that experiences a data breach will automatically face such a penalty.

The more useful question is whether future investigations will focus not only on the fact that a breach occurred, but also on what the organization knew beforehand, how it handled known weaknesses, how quickly it detected the intrusion, whether it limited the damage, and how clearly it informed those affected.

Terms That May Need a Quick Explanation

Editor’s Note

What bothers me most about these cases isn’t how clever the hackers may have been. It’s the much less glamorous stuff: a known weakness that wasn’t fixed in time, an intrusion that went unnoticed, or an investigation that took weeks just to establish what happened.

Companies spend serious money on security technology. Fair enough. But someone still has to maintain the systems, pay attention to the warning signs, and decide who should be allowed to retrieve millions of customer records.

It’s rather like installing an enormous steel vault door and then discovering that nobody was keeping an eye on the little maintenance hatch beside it.

And when something does go wrong, customers usually have no easy way of knowing precisely what the organization discovered, when it discovered it, or what it did next.

I’m starting to think that “We’re victims of a cyberattack too” shouldn’t be the end of the conversation. The criminals are responsible for their attacks, of course. But an organization that accepts responsibility for storing people’s personal data should also have to explain how well it protected that information.

References