Last October was a rough month for corporate security in Japan, to put it mildly. On October 8th, JPCERT, a non-profit cyber incident response organization in the country, issued an unusual alert regarding a wave of unauthorised access leading to data leaks across domestic organisations. With breaches involving leaks in the tens of millions, Prime Minister Sanae Takaichi stepped in during a cabinet meeting on October 26th, instructing officials to cooperate with overseas authorities and global tech giants to track down the attackers and swiftly patch the vulnerabilities.

Naturally, the bleeding didn't stop outside the gaming sector. Game developers, publishers, merchandise stores, and digital storefronts all admitted to falling victim. And this is hardly just a Japanese phenomenon; throughout 2026, the Western and South Korean gaming industries have been battered by similar breaches.

Capcom took the heaviest blow of all. In an official announcement on October 22nd, the company revealed that its unified account service, Capcom ID, had suffered unauthorised third-party access. Identifying info including email addresses, account creation dates, last login timestamps, and connection IPs for 11.77 million users worldwide were compromised. For 43 of those accounts, even birth dates, genders, countries, and nicknames were leaked.

The damage went well beyond mere data exposure. Unauthorised actors managed to change passwords on 196 accounts, and 19 of those intrusions reached deep into the 'e-Capcom' official online store's My Page, exposing names, addresses, and purchase histories. Capcom spotted the intrusion on October 19th and reported it to the police and the Personal Information Protection Commission in Japan on the 21st. It marks their first major security crisis in six years, following the 2020 ransomware incident.

Bandai Namco took hits twice through external partners. On October 27th, the company announced that Yumirink, the vendor handling 'Bandai Namco ID' mail services, was breached, leaking the email addresses of 346,247 members of 'The Gundam Base Members' Gunpla store service. Just a day prior on the 26th, logistics subsidiary Bandai Logipal System suffered unauthorised access, warning that shipping details (names, addresses, phone numbers) for 'Ichiban Kuji Online' may have been compromised.

Bushiroad acknowledged a breach on that exact same day. The development partner system for 'BanG Dream! Our Notes' was hit by unauthorised access, leaking personal data such as phone numbers and addresses for roughly 13,000 closed beta applicants and customer support users.

Square Enix dealt with a slightly different flavour of security trouble. On October 19th, the company announced via the 'Final Fantasy 14' official site that it detected unauthorised logins to 'Square Enix accounts' using combinations of IDs and passwords likely leaked from entirely separate platforms. While their own database wasn't breached, credentials leaked elsewhere were weaponised directly against player accounts.

Merchandise retailers couldn't dodge the bullet either. Figure maker Good Smile Company saw its official online shop compromised. Between October 19th and 22nd, third parties repeatedly accessed member info through unauthorised logins. From the afternoon of the 21st until the site was pulled offline on the morning of the 23rd, malicious code was even planted right on the credit card checkout page. The company explained that administrator privileges were hijacked via a system vulnerability. Roughly 2,800 people may have had their 16-digit card numbers and security codes leaked, and the web shop remains shut down since the 23rd.

Western studios have spent the entire year grappling with security breaches as well. Rockstar Games, gearing up for the launch of 'GTA 6', was targeted by a hacking group back in April. The attackers claimed they breached cloud storage through Anodot, a cloud cost analytics service utilised by Rockstar. Rockstar acknowledged that a limited amount of non-sensitive company data was accessed in connection with a third-party leak. By mid-April, the group dumped roughly 78.6 million lines of analytics data, though player accounts and game source code were reportedly untouched.

Valve reported in August that European Steam hardware buyer data was leaked. CEVA Logistics, handling European deliveries, came under attack in late July, exposing names, addresses, phone numbers, Steam emails, and order histories, though passwords and payment details thankfully remained safe.

Late October brought bad news for Warhorse Studios, the developer behind 'Kingdom Come: Deliverance'. Warhorse announced on October 27th that there had been unauthorised access to internal systems and company data. CEO Martin Frývaldský stated that this is a serious incident for both the company and everyone affected. The firm is investigating alongside security experts and cooperating closely with authorities. Warhorse is currently developing the next 'Kingdom Come' alongside an open-world Lord of the Rings RPG.

Some hacks even shook up the gameplay experience directly. In late December of last year, Ubisoft's 'Rainbow Six Siege' suffered an intrusion where a hacker broke into game servers and showered players with billions of in-game 'R6 Credits'. Rare items that are normally a pain to unlock were handed out freely, and some accounts were inexplicably banned and then unbanned. Ubisoft acknowledged the security blunder and temporarily took servers offline.

South Korea isn't safe either. Kakao Games announced on September 16th that personal info was leaked after its creator support program 'Partners' and remote play service 'RINK' fell victim to external attacks exploiting system vulnerabilities. Meanwhile, Wemade's Wemix Foundation disclosed on July 26th that roughly 5.22 million 'Wemix Dollars' stablecoins were minted without authorisation. The foundation explained that attacker hijacked admin privileges by exploiting a vulnerability left over from a 2022 upgrade.

So why the sudden surge in hacks? While no attacker has formally raised their hand to say 'AI did it,' all the circumstantial evidence points squarely in that direction. JPCERT noted in its analysis that an examination of the attack servers presumably used in Japan's wave of leaks revealed that the bad actors used AI to scan known vulnerabilities and launched attacks via APIs. They dissected Android application package (APK) files to locate server-communicating APIs before probing for weaknesses.

Experts point out that AI has effectively lowered the barrier to entry for cyberattacks. Back in the day, finding a single vulnerability required skilled hackers to tear down apps, analyse network traffic, write custom exploit code, and test things one by one. Given the heavy investment of time and manpower, attackers naturally focused on high-value targets, leaving smaller services or those with minor sensitive data relatively unbothered. Now, however, AI handles a massive chunk of that heavy lifting. Deconstructing apps to unearth APIs and automatically scanning for known flaws has become infinitely faster and cheaper.

It is a fundamental shift in the balance of power between attackers and defenders. While defenders have to plug every single hole across countless systems, attackers only need to find one weak spot. AI has vastly expanded the scope and speed at which attackers can sweep for targets, and corporate patch cycles simply cannot keep up with that pace. The Japanese government has asked companies like Anthropic and OpenAI to broaden access to advanced AI models specifically for vulnerability detection—a clear admission that fighting AI-accelerated attacks requires AI defence.

Just how rapidly AI can uncover vulnerabilities was painfully demonstrated during the late October 'PHP' crisis. Two critical vulnerabilities allowing unhandled remote code execution on servers were discovered in PHP, the programming language underpinning countless websites. The real kicker was that this intelligence leaked ahead of the official patch release. While PHP maintainers rushed out a fixed version on the night of October 21st (Korea time) a day ahead of schedule, attack attempts were already underway. Amazon caught wind of exploit attempts four days prior to disclosure, and Cloudflare reported that malicious requests spotted across its network immediately following the reveal skyrocketed into the millions.

Japan, already battered by ongoing security breaches, went into absolute panic mode over the PHP incident. Prime Minister Takaichi posted an urgent plea on X demanding action by the end of the night, prompting numerous organisations—ranging from banks and local governments to online retailers—to pull the plug on their services as a precautionary measure ahead of the patch. In the gaming space, Cygames temporarily shut down 'Umamusume: Pretty Derby' and 'Granblue Fantasy', while Sega temporarily closed Sega ID and its arcade rhythm game member sites.

Meanwhile, a glaring common thread running through these gaming industry incidents is the reliance on 'third-party vendors'. Rockstar (Anodot), Valve (CEVA), Bandai Namco (Yumirink), and Bushiroad (development contractor) all saw their outer defences breached through external partners or subsidiaries rather than main headquarters. It ties directly into the rising trend of attackers using AI to rapidly hunt down the weakest links in a supply chain.

Game companies are prime targets for hackers by default, hoarding user profiles, payment details, and unreleased development assets. The core issue is that outsourcing inherently creates blind spots. Companies hand tasks over to external vendors either to tackle workloads they cannot manage internally or to cut costs. Naturally, it is rarely straightforward for a headquarters to directly audit and control a vendor's security posture. As collaborative networks expand, the attack surface expands right along with them. Now that AI has cheapened the cost of vulnerability hunting, experts argue that companies need systems capable of governing external vendors and services just as fiercely as headquarter security—though making that happen is going to be an uphill battle.