• Overview
• Attack Efficiency Analysis
• Invisible Exposure Matrix
• Observation-to-Disclosure Model
• Synthetic Scenario Lab
• Evidence & Provenance
• Research Methodology

Evidence & Provenance

LAC WATCH is verified as a public source. Its disclosure counts remain disclosure counts.

• lac-watch-2026-10-15 · PUBLIC_SOURCE · VERIFIED

  国内で相次ぐWebシステムからの情報漏えい～ラックの観測から見える変化と、企業が今とるべき対策

  LAC / 株式会社ラック · 2026-10-15

  https://www.lac.co.jp/lacwatch/alert/20261015_004996.html

  As of 2026-10-06, LAC counted 119 in-scope public disclosures, of which 81 (about 68%) were disclosed from July 2026 onward. This is a disclosure count, not an attack-attempt count and not an attack-efficiency rate.

  Scope: Not a national census. Disclosure counts are LAC's public-information sample. C119 percentages are LAC-handled cases only. JSOC series is LAC sensor coverage only.

  Definition: LAC independent tally of Japanese corporate public disclosures of personal-data leakage or possible leakage associated with unauthorized access to web systems, web services, or smartphone apps. Separate series: Cyber Emergency Center case-mix; JSOC monitored suspicious traffic.

  Limitations: Counts may change as investigations proceed. Leakage-possible and unconfirmed cases are included. Do not generalize to the entire Japanese cybersecurity environment. Do not divide these disclosures by network requests.

  Empirical quantitative: yes · classification STATED

• lac-c119-mix-2026-q3 · PUBLIC_SOURCE · VERIFIED

  Cyber Emergency Center dispatch mix, server intrusion share

  LAC / 株式会社ラック · 2026-10-15

  https://www.lac.co.jp/lacwatch/alert/20261015_004996.html

  Server intrusion was 52% of C119 dispatches in Jul–Sep 2026, versus 30% in the prior quarter. ID misuse and web-application exploitation accounted for about 70% of intrusion paths in that mix.

  Scope: LAC-handled cases only. Explicitly not a measure of national incident occurrence.

  Definition: Share of LAC Cyber Emergency Center dispatches classified as server intrusion.

  Limitations: A rising share of one responder's caseload is not an attack-efficiency rate and is not a national trend.

  Empirical quantitative: yes · classification STATED

• lac-disclosure-latency-2026 · PUBLIC_SOURCE · VERIFIED

  Days from detection/recognition to first public disclosure

  LAC / 株式会社ラック · 2026-10-15

  https://www.lac.co.jp/lacwatch/alert/20261015_004996.html

  Mean latency fell from 10.9 days in May 2026 to 2.9 days in September 2026; September median was 1 day. LAC states that a rise in disclosure counts should not be read as a simple rise in attacks.

  Scope: Subset of LAC's public-disclosure sample with recoverable dates. Not all disclosures.

  Definition: Mean (and September median) days from case detection/recognition to first public disclosure, among in-scope Japanese corporate disclosures where both dates could be read from public materials.

  Limitations: Only cases with both dates. Disclosure acceleration can raise public counts without raising underlying incidents.

  Empirical quantitative: yes · classification STATED

• lac-efficiency-hypothesis · PUBLIC_SOURCE · VERIFIED

  Hypothesis: fewer attempts may still produce more efficient compromise

  LAC / 株式会社ラック · 2026-10-15

  https://www.lac.co.jp/lacwatch/alert/20261015_004996.html

  LAC presents as a hypothesis, requiring further verification, that attackers may be locating weaknesses more efficiently. This Observatory does not treat that hypothesis as a measured attack-efficiency rate.

  Scope: Two non-matched LAC observation systems. Not a confirmed success rate.

  Definition: Qualitative comparison of JSOC monitored suspicious traffic (not substantially increased on a longer view) with a rising share of server-intrusion dispatches in C119.

  Limitations: LAC states verification would require attack targets, success/failure, API access patterns, and attempt intervals. Units are not matched.

  Empirical quantitative: no · classification INFERENCE

• lac-ai-attribution-jp · PUBLIC_SOURCE · VERIFIED

  No public evidence of AI-agent involvement in the Japanese series

  LAC / 株式会社ラック · 2026-10-15

  https://www.lac.co.jp/lacwatch/alert/20261015_004996.html

  LAC states there is presently no public evidence that AI agents were directly involved in the Japanese series. Unsupported AI attribution is excluded from confirmed findings.

  Scope: Public evidence reviewed by LAC for the Japanese cases discussed.

  Definition: Presence or absence of public evidence that AI agents directly participated in the Japanese disclosure series.

  Limitations: Absence of public evidence is not proof of absence. Overseas reports are a different population.

  Empirical quantitative: no · classification EXCLUDE

• gambit-overseas-ai-campaign · PUBLIC_SOURCE · UNVERIFIED

  Overseas AI-harness campaign reported by Gambit Security

  Gambit Security, as cited by LAC · 2026-10-15

  https://www.lac.co.jp/lacwatch/alert/20261015_004996.html

  Cited only as overseas context. Excluded from confirmed findings about Japanese incident frequency or attack efficiency.

  Scope: Overseas retailer-targeting campaign as reported, not the Japanese public-disclosure series.

  Definition: Third-party campaign narrative cited by LAC. Not independently re-measured here.

  Limitations: Secondary citation. Different geography and population. Not used as a numerator or denominator.

  Empirical quantitative: no · classification EXCLUDE

• aeie-synthetic-lab · SYNTHETIC · VERIFIED

  AEIE synthetic scenario lab

  SHIRO & Co. Threat Observatory · 2026-10-21

  No public URL · synthetic

  Scenario outputs illustrate measurement distortions. They are not real-world attack efficiency.

  Scope: Synthetic bounded populations only.

  Definition: Seeded closed-form expected counts: floor(n × p) under stated independence assumptions.

  Limitations: No empirical population. Must not be mixed into empirical charts.

  Empirical quantitative: no · classification STATED