A survey of underground forums where hackers trade stolen material has found growing demand for Japanese personal data, according to 読売新聞. The Tokyo security firm Mitsui Bussan Secure Directions carried out the research, monitoring roughly 30 English-, Russian- and Chinese-language sites where active buying and selling was under way between October 15 and 27, the newspaper reports.
The firm examined posts and sample data that sellers had made public. Its engineers found at least seven listings on English-language boards offering customer records from Japanese companies — including IT and transport service providers — that had disclosed breaches between mid-September and late October. Some users also posted requests to buy information from companies by name after those firms went public with leaks.
Why it matters
The findings suggest that criminals are tracking Japanese corporate breach announcements and news coverage, then building a market around the data those disclosures reveal. Hideya Urata, the engineer who led the survey, said the pattern shows demand for leaked Japanese information is emerging as offenders follow company statements and press reports, according to 読売新聞.
The concern is volume. Urata said leaked data takes time to analyze and price, which means trading is likely to pick up rather than fade. He warned that unauthorized access carried out specifically to sell what is taken could increase further.
Prices, samples and what sells
One English-language post advertised records for about 11 million customers, including email addresses, names and phone numbers, and directed buyers to place orders through direct messages on Telegram, the newspaper reports.
Pricing reflects how easily data can be turned into profit, with extra detail pushing values higher. Credit card information was being traded on a specialist marketplace at $24 per record, roughly 3,800 yen. On a Chinese-language site, images of Japanese driving licences bundled with car insurance paperwork were offered as a set of 28 items for $84, about 13,000 yen.
Credentials tell a different story. With multi-factor authentication now widespread, stolen IDs and passwords are harder to exploit on their own. One post described their value as approaching zero, and some were published free as a way for sellers to advertise.
Whether any of the advertised material actually changed hands is unclear. Negotiations took place on encrypted messaging apps chosen by the posters, so the firm could not confirm completed sales.
A moving target for investigators
Authorities in various countries try to disrupt these marketplaces by seizing servers or removing the domain names needed to reach them. The effect is temporary: similar sites are numerous, and takedowns are followed by relaunches, producing a cycle that repeats.
Dark web sites are portions of the internet reachable only through anonymizing software. They host leaked personal information and marketplaces for malicious software, and simply visiting one carries risk — a device can be infected with malware that then steals data stored on it.
Urata's advice to companies is to gather current threat intelligence through cybersecurity providers, check their own systems thoroughly for weaknesses, and extend warnings to business partners as well. He also pointed to a broader problem: a run of cyberattacks has exposed gaps in Japanese corporate defenses, making the country's organizations easier targets.
Watch for further breach disclosures from Japanese firms and whether the data they reveal shows up for sale in the weeks that follow.
