[ITmedia Enterprise] Is it your responsibility to just send an apology email? “Three mechanisms” missing in the era of personal information leaks

The study session was moderated by Team Mirai leader Takahiro Yasuno (a member of the House of Councilors), and was attended by nonpartisan members of the Diet. The three people who took the stage were Nobu Ueno (Representative Director) of Tricorder, which handles penetration testing for companies, Yutaka Sejiyama (Assistant Director, Security Research Center) of Macnica, which deals with semiconductors and cybersecurity, and Yutaka Makino (Representative Attorney) of Makino Law Office, who is representing the Times Car class action lawsuit.

Individual efforts have already exceeded their limits.

The current understanding that AI has changed the quantity and quality of attacks was shared as a premise. "The 2026 Vulnerability Forecast Update: Navigating the AI ​​Epoch" (Note 2) published by FIRST, an international group of security organizations, on June 15, 2026 raised the forecast for the number of CVE registrations in 2026 to approximately 66,000, based on the spread of vulnerability detection using AI. This is expected to exceed the previous record high of approximately 48,000 cases in 2025 (approximately 130 cases per day).

Mr. Ueno explained the reason for the widening of attacks.

"Until now, Japan was protected by the Japanese language barrier, and we were able to identify suspicious Japanese.However, now by giving instructions to AI, it can create natural text that conveys a sense of urgency, similar to what a financial institution would issue.The hurdles for attacks from overseas have been extremely lowered," Ueno said.

The threat after a leak has also changed. Mr. Sejiyama pointed out that phishing emails containing specific information such as leaked accommodation history have already been observed. If the ability to reset passwords using an address or phone number is misused, the very basis of identity verification could be undermined. Mr. Makino also receives inquiries about identity theft, such as ``people applying for loans using information on their driver's licenses that were leaked.'' Even data leaked in separate cases can be used as material for identity theft if compared using AI. The problem does not go away as time passes after information is leaked, and the number of ways it can be exploited increases.

To create a society where leaks are not exploited

The measures presented at the study session can be organized into the following three categories.

The first and third proposals aim not to ``prevent'' damage from occurring, but to ``make sure that even if it does occur, it will not be fatal.'' Don't leak information you don't have. If the leaked information does not allow people to impersonate themselves, the actual damage caused by the leak will be reduced. The second is the motivation to move companies in that direction. Mr. Makino pointed out that in leakage cases where the amount of compensation per person is small, the cost and effort of individual litigation exceeds the compensation, making it easy for victims to give up on their lives. He also mentioned that the number of guidance and recommendations issued by the Personal Information Protection Commission is small, making it difficult for supervisory pressure to function effectively.

On the flip side, none of these three are currently functioning adequately. In order to use both car sharing and mail order services, it is practically inevitable to register your name, address, and phone number. The registration form still asks for address and phone number. In the event of a leak, you will only receive one email apologizing, and the rest will be left to the individual's discretion, with the message, ``Please be careful of suspicious communications.''

The National Cyber ​​Control Office's ``Cyber ​​Response Special Site'' (Note 3) has multiple consultation centers for individuals, including the Prime Minister's Office, the National Police Agency, the National Consumer Affairs Center of Japan, and the Information-technology Promotion Agency (IPA). Having all the information in one place is a step forward. On the other hand, the current situation in which victims cannot tell at a glance where they should go is inadvertently demonstrating the need for the ``single point of contact'' that Mr. Ueno called for at the study session.

My cell phone still receives SMS from time to time asking me to pay the gas bill I should have paid. It's a story that can be ignored. However, whether we move towards a society in which everyone continues to be patient and say, ``Ignore it,'' or a society in which information cannot be misused even if it is leaked, will be determined not by individual efforts but by the design of the system. Even if the fact that the information was leaked does not change, we should be able to create a system in the future that will not cause any problems even if the information is leaked.