Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks

**Executive Summary:** JPCERT/CC and Macnica report a wave of personal data leaks affecting Japanese organizations in mid-to-late 2026 driven by API abuse, exploitation of known flaws (including Metabase CVE-2026-72898), stolen API keys, and inadequate API/access controls; incidents include multiple large breaches (millions of records), published IoCs (IP addresses and User-Agent strings), recommended mitigations (upgrade Metabase, rate-limit APIs, enforce access control, rotate credentials), and guidance for log review and temporary workarounds.