Japan's Ministry of Internal Affairs and Communications has issued a cybersecurity warning to companies operating websites and mobile applications, after a wave of data breaches linked to weak security measures.

The ministry urged businesses, particularly those handling personal information, to fix common vulnerabilities and strengthen protection against unauthorised access. The warning follows a similar advisory from the National Center of Incident Readiness and Strategy for Cybersecurity, operating under the Cabinet Secretariat, and a 6 November advisory from the National Cybersecurity Office urging businesses of all sizes to run continuous vulnerability assessments and build security in from the design stage.

Japan has been hit by a sustained run of disclosures since late September, with more than 18 companies reporting breaches or data leaks. The country's national computer emergency response team, JPCERT/CC, found that attackers used artificial intelligence to scan for known vulnerabilities and strike through companies' application programming interfaces.

The disclosed incidents include about 22.5 million records at software maker Sourcenext, about 11.18 million at Burger King Japan and about 6.6 million accounts at car-sharing service Times Car. Prime Minister Sanae Takaichi took the unusual step on 21 October of using her own social media account to ask everyone running a PHP website to apply security patches that night, or take the site offline if they could not patch quickly.