Website data breaches hit 216 cases, 2.6 times last year: Macnica

The surge in website-based data breaches marks a shift from attacks that require breaking into internal networks. Instead, hackers are exploiting weaknesses directly in public-facing websites and apps, sometimes logging in as legitimate users to view other customers' information. This approach avoids the need to penetrate a company's internal systems.

Macnica's data shows reported cases rising sharply from this summer, with 101 cases in October alone. Recent incidents include Sourcenext, suspected of a breach involving about 22.5 million customer records, and travel booking site Skyticket. The targets are also diversifying: while e-commerce sites previously accounted for a large share, attacks now hit membership sites, booking platforms, library catalog systems, and university facility reservations.

Yutaka Sejiyama of Macnica stressed that companies need to identify and fix weaknesses in their own systems, noting that vulnerabilities specific to individual websites cannot necessarily be fixed by updating common software. Hiroshi Tokumaru of EG Secure Solutions pointed out that security measures are often given lower priority for websites not handling confidential information or financial transactions. As AI advances, attacks that were previously too time-consuming are becoming easier, and Tokumaru said the balance of power between attackers and defenders has shifted.