Japan data leaks began with attacks on mobile apps

Guardsquare has warned that a string of data leaks in Japan began with attacks on mobile apps. Attackers extracted API keys from publicly available apps and used them to reach backend systems, the security company said.

The incidents affected consumer-facing businesses including restaurant, karaoke, retail and car rental operators. Published reports cite millions of customer records exposed across several companies.

Guardsquare's analysis says attackers begin by examining smartphone apps to identify API endpoints and embedded keys. They then target internal APIs that are not visible through the app's normal user interface, using techniques including privilege changes, unauthorised account creation, altered request headers and malformed authentication tokens.

Published accounts of the breaches in Japan point to large-scale losses of customer information. They include member information for about 10.78 million customers at a barbecue restaurant chain, personal information on about 8.72 million customers at a karaoke chain, account information for up to 6.43 million customers at a second-hand goods retailer, 6.6 million accounts at a car rental operator including more than one million driving licence images, and member information for more than 1.73 million customers at a discount retail chain.

Attack route

Guardsquare said the methods are well known, even if the speed and scale of the recent attacks have drawn attention. Many organisations still focus their security efforts on backend infrastructure while giving less scrutiny to the mobile apps that connect customers to those services, it argued.

One common weakness is hardcoded secrets in app code. If developers leave credentials or keys in a mobile application, attackers can recover them through static analysis after downloading the app from public stores.

Guardsquare also pointed to growing use of reverse engineering tools to inspect app code and behaviour. Tools such as JEB, Ghidra and Frida have long been used by security researchers and attackers alike, but the company said artificial intelligence is lowering the effort needed to scan large numbers of applications for useful secrets.

Last month, Anthropic reported that Claude AI had been abused to mass-download, decompile and scan 1.8 million Android APKs in search of credentials, keys and other secrets, according to Guardsquare.

Consumer targets

The incidents in Japan show why ordinary consumer services can be attractive targets. Retail, hospitality and mobility apps may not appear as sensitive as banking services, but they often hold large volumes of names, contact details, account records and identity documents.

Once keys are extracted, attackers do not necessarily need to build a convincing fake version of an app. They can use the credentials directly with scripts, bots or automated agents to query backend systems and collect data at scale.

This approach overlaps with credential stuffing and API abuse, where access to backend services depends too heavily on secrets that can be recovered from the client side, Guardsquare said. It added that the recent Japanese cases may indicate a higher degree of automation than older bot-driven campaigns, although the full picture remains unclear.

Defensive steps

Guardsquare said organisations should start by removing hardcoded secrets from mobile apps and using continuous security testing during development to catch such issues early. It also recommended stronger code protection measures to make reverse engineering harder and more costly.

Beyond code obfuscation, apps should include runtime defences that can detect tampering or debugging attempts while the software is running, Guardsquare said. These checks can be configured to limit functionality or stop the app if suspicious behaviour is detected.

On the server side, businesses should not assume that any request carrying a valid-looking key comes from a genuine application, the company said. Instead, it urged the use of app attestation so backend systems can verify whether an app is authentic, unmodified and running on a trusted device before granting access.

The broader lesson from the Japanese cases, Guardsquare said, is that mobile apps have become a primary route into customer data in sectors well beyond finance. “The ongoing attacks in Japan are (unfortunately) a perfect illustration of how wide the implications of insufficient or outdated mobile application protections can be,” said Jason Cortlund, Technical Writer at Guardsquare.