Japan cyber emergency: your mobile app API keys are public

Japan's cyber emergency started with API keys hidden in mobile apps. On Friday, Digital Minister Masaaki Taira called a crisis meeting and described a "cybersecurity emergency" after a wave of breaches at Japanese companies. The Financial Times counts at least 20 affected firms. The detail that matters for every business with an app: Japan's national CERT says attackers took apps from the public app stores, pulled out the API endpoints and keys, and then called internal APIs the app screens never show. If your app ships with a key, that key is public.

What actually happened

According to heise online, the attacks started at the end of September. Tokyo Metro disclosed 59,000 leaked customer email addresses on September 27. The restaurant chain Yakiniku King reported that data for 10.8 million customers was copied from its membership system. The Japan Atomic Energy Agency said ID documents for 175 people leaked through a contractor's cloud platform. Cybersecurity minister Toshiharu Furukawa called the situation "extremely critical." Japan's banking supervisor told banks to stop accepting driver's licenses alone as ID for new accounts.

On October 8, JPCERT/CC published an alert that named three attack patterns, as The Hacker News reports:

• Management API abuse. Attackers reverse-engineer public smartphone apps to find endpoints and keys, then probe internal APIs. They also reuse API keys stolen from other breaches.
• Scanning for known flaws, including theft of configuration and backup files.
• Metabase CVE-2026-72898, a CVSS 10.0 SQL injection in the open-source BI tool that has been on CISA's KEV list since August.

Park24, which runs the Times Car car-sharing service, reported that data on about 6.6 million accounts was obtained, with ID images from about 1.6 million accounts. Security firm Macnica counts 119 similar incidents in Japan through October 6, against 84 for all of 2025.

Why mobile app API security matters for your business

Most small-business apps we audit share one weakness: the backend trusts the app. The app hides the admin button, so nobody checks permissions on the admin endpoint. The app has a key baked in, so that key can read everything. Obfuscation does not fix this. Anyone with a decompiler and an afternoon can read your APK.

The fix is not exotic, and JPCERT's list matches ours:

• No secrets in the client. If the key is in the app bundle or the browser, treat it as published. Move privileged calls behind your own server.
• Check authorization on every endpoint, not just the ones the UI links to.
• Rate-limit the expensive paths: login, password reset, SMS, search.
• Short-lived tokens you can revoke fast.
• Delete data you no longer need. Ten million rows you deleted cannot leak.

Sources: heise online, The Hacker News.